cve.bz

CVE-2017-3204

8.1 highEPSS 3.2%

The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism.

Severity

CVSS 3.1

8.1 high
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
3.2% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
CWE
CWE-310
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-xhjq-w7xm-p8qjGogolang.org/x/crypto<0.0.0-20170330155735-e4e2799dd7aa0.0.0-20170330155735-e4e2799dd7aa
GO-2020-0013Gogolang.org/x/crypto<0.0.0-20170330155735-e4e2799dd7aa0.0.0-20170330155735-e4e2799dd7aa

References

Check your stackJSON