How to fix CVE-2024-45337 – Step-by-Step Guide
CVE-2024-45337 addresses a critical vulnerability in Go's crypto/ssh package. This flaw, named "Misuse of ServerConfig.PublicKeyCallback", could lead to unauthorized SSH authentication bypass in Go applications. It affects Go versions prior to 1.22.10 and 1.23.4.
What is Go crypto/ssh – Misuse of ServerConfig.PublicKeyCallback?
The vulnerability stems from a logic flaw in crypto/ssh's authentication flow. Specifically, applications using ServerConfig.PublicKeyCallback may incorrectly authorize connections. This occurs when the callback approves a public key, but the subsequent authentication process fails, yet the connection is still granted. An attacker could exploit this to bypass intended authentication.
Impact and Risks for your Infrastructure
This critical flaw enables unauthorized SSH authentication bypass in affected Go applications. Attackers can authenticate to SSH servers using any public key, even if not properly authorized, by exploiting the PublicKeyCallback misuse. This grants unauthorized access to systems, posing a severe risk to data integrity and confidentiality.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-45337, update your Go installations to version 1.22.10 or later, or 1.23.4 or later. Verify the fix by ensuring your SSH server applications correctly reject unauthorized public key authentications. Review ServerConfig.PublicKeyCallback implementations to confirm proper authorization logic.
- 1Upgrade Go to 1.22.10+ or 1.23.4+.
- 2Review your PublicKeyCallback implementation to ensure it rejects unauthorized keys.
- 3Add explicit key allowlist validation inside PublicKeyCallback.
- 4Rotate SSH host keys and audit SSH access logs for anomalies.
- 5Run static analysis (govulncheck) to detect usage of vulnerable patterns.
- 6Pin allowed public keys in your callback rather than relying on post-callback checks.