How to fix CVE-2024-45337 – Step-by-Step Guide
CVE-2024-45337 addresses a critical vulnerability (CVSS 9.1) in the Go standard library's `crypto/ssh` package. This flaw, published on 2024-12-11, could lead to unauthorized SSH authentication bypass in affected Go applications.
What is Go crypto/ssh – Misuse of ServerConfig.PublicKeyCallback?
This vulnerability stems from a logic flaw in `crypto/ssh`'s `ServerConfig.PublicKeyCallback` implementation. Applications using this callback may incorrectly grant access if the callback approves a public key, even if subsequent authentication steps fail. This bypasses intended security checks, affecting Go versions prior to 1.22.10 and 1.23.4.
Impact and Risks for your Infrastructure
The critical impact of CVE-2024-45337 is an unauthorized SSH authentication bypass. Attackers can exploit this flaw to gain unauthorized access to SSH servers running vulnerable Go applications, potentially using any public key. This compromises server integrity and data security.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-45337, immediately upgrade your Go runtime to version 1.22.10 or later, or 1.23.4 or later. Recompile and redeploy any Go applications utilizing `crypto/ssh` with the patched Go version. Verify the fix by checking your Go version and ensuring all affected services are running the updated binaries.
- 1Upgrade Go to 1.22.10+ or 1.23.4+.
- 2Review your PublicKeyCallback implementation to ensure it rejects unauthorized keys.
- 3Add explicit key allowlist validation inside PublicKeyCallback.
- 4Rotate SSH host keys and audit SSH access logs for anomalies.
- 5Run static analysis (govulncheck) to detect usage of vulnerable patterns.
- 6Pin allowed public keys in your callback rather than relying on post-callback checks.