Vulnerabilities > CVE-2017-3204 - Security Bypass vulnerability in Golang Go SSH Library
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL network
golang
Summary
The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 5 |