What is GHSA-8wxx-35qc-vp6r?

GHSA-8wxx-35qc-vp6r is a security advisory published by GitHub Security Advisories with Critical severity. Missing key verification in gost

Which CVE IDs does GHSA-8wxx-35qc-vp6r cover?

GHSA-8wxx-35qc-vp6r covers the following CVE IDs: CVE-2024-39223. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8wxx-35qc-vp6r?

GHSA-8wxx-35qc-vp6r has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-8wxx-35qc-vp6r?

GHSA-8wxx-35qc-vp6r affects 1 product, including: go/github.com/ginuerzh/gost:\u003c= 2.11.5.

GHSA-8wxx-35qc-vp6rCriticalCVSS 9.8

Missing key verification in gost

Vendor

GitHub Security Advisories

Published

July 3, 2024

Last Modified

October 25, 2024

🔗 CVE IDs covered (1)

CVE-2024-39223 →

📋 Description

An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey

🎯 Affected products1

go/github.com/ginuerzh/gost:<= 2.11.5

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2024-39223
https://github.com/ginuerzh/gost/issues/1034
https://gist.github.com/nyxfqq/a7242170b1118e78436a62dee4e09e8a
https://github.com/ginuerzh/gost/blob/729d0e70005607dc7c69fc1de62fd8fe21f85355/ssh.go#L229
https://github.com/advisories/GHSA-8wxx-35qc-vp6r