Your submission was sent successfully! Close

CVE-2017-3204

Published: 4 April 2017

The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism.

Notes

AuthorNote
jdstrand
ubuntu-snappy and snapd contain embedded copies of golang-go.crypto
tyhicks
snapd doesn't use this particular part of golang-go.crypto as it
doesn't act as a SSH client
Priority

Low

CVSS 3 base score: 8.1

Status

Package Release Status
golang-go.crypto
Launchpad, Ubuntu, Debian
artful Ignored
(reached end-of-life)
bionic Not vulnerable
(1:0.0~git20170629.0.5ef0053-2)
cosmic Not vulnerable
(1:0.0~git20180614.a8fb68e-1)
disco Not vulnerable
(1:0.0~git20180614.a8fb68e-1)
eoan Not vulnerable
(1:0.0~git20180614.a8fb68e-1)
focal Not vulnerable
(1:0.0~git20180614.a8fb68e-1)
groovy Not vulnerable
(1:0.0~git20180614.a8fb68e-1)
hirsute Not vulnerable
(1:0.0~git20180614.a8fb68e-1)
impish Not vulnerable
(1:0.0~git20180614.a8fb68e-1)
jammy Not vulnerable
(1:0.0~git20180614.a8fb68e-1)
precise Does not exist

trusty Does not exist

upstream
Released (1:0.0~git20170407.0.55a552f+REALLY.0.0~git20161012.0.5f31782-1)
xenial Needed

yakkety Ignored
(reached end-of-life)
zesty Ignored
(reached end-of-life)
Patches:
upstream: https://github.com/golang/crypto/commit/e4e2799dd7aab89f583e1d898300d96367750991
snapd
Launchpad, Ubuntu, Debian
artful Ignored
(code not used)
bionic Ignored
(code not used)
cosmic Ignored
(code not used)
disco Ignored
(code not used)
eoan Ignored
(code not used)
focal Ignored
(code not used)
groovy Ignored
(code not used)
hirsute Ignored
(code not used)
impish Ignored
(code not used)
jammy Ignored
(code not used)
precise Does not exist

trusty Does not exist
(trusty was ignored [code not used])
upstream Needs triage

xenial Ignored
(code not used)
yakkety Ignored
(code not used)
zesty Ignored
(code not used)
ubuntu-snappy
Launchpad, Ubuntu, Debian
artful Does not exist

bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

groovy Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

yakkety Does not exist

zesty Does not exist