CVE-2017-3204

The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks

published April 4, 2017

CVSS
—
EPSS
3%
Percentile
87.8
In the wild
Unconfirmed
What it is

The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03156 · 87.8th percentile
Published
2017-04-04T14:00Z
EPSS history
Timeline
  • 04 APR 14:00Z
    The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks
    cvelistv5