How to fix CVE-2024-45337 – Step-by-Step Guide
CVE-2024-45337 addresses a critical authentication bypass vulnerability in Go's crypto/ssh library. This flaw, named "Misuse of ServerConfig.PublicKeyCallback," allows unauthorized access to SSH servers. It impacts applications using specific versions of the Go standard library.
What is Go crypto/ssh – Misuse of ServerConfig.PublicKeyCallback?
This vulnerability stems from a logic flaw in Go's crypto/ssh package. Applications using `ServerConfig.PublicKeyCallback` may incorrectly authorize connections. Even if the callback approves a key, a subsequent authentication failure can still grant unauthorized access due to a flaw in the authentication flow.
Impact and Risks for your Infrastructure
The primary impact is an unauthorized SSH authentication bypass in affected Go applications. Attackers can exploit this to gain access to SSH servers using any public key, bypassing intended security controls. This could lead to critical system compromise, data breaches, and unauthorized infrastructure access.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-45337, immediately upgrade your Go applications. Update to Go version 1.22.10 or later, or Go 1.23.4 or later. After upgrading, rebuild and redeploy affected services to ensure the fix is applied and verify SSH authentication functions correctly.
- 1Upgrade Go to 1.22.10+ or 1.23.4+.
- 2Review your PublicKeyCallback implementation to ensure it rejects unauthorized keys.
- 3Add explicit key allowlist validation inside PublicKeyCallback.
- 4Rotate SSH host keys and audit SSH access logs for anomalies.
- 5Run static analysis (govulncheck) to detect usage of vulnerable patterns.
- 6Pin allowed public keys in your callback rather than relying on post-callback checks.