How to fix CVE-2024-45337 – Step-by-Step Guide
CVE-2024-45337 addresses a critical vulnerability in the Go crypto/ssh library. This flaw could lead to unauthorized access to SSH servers built with Go. Immediate action is required to secure your applications.
What is Go crypto/ssh – Misuse of ServerConfig.PublicKeyCallback?
This vulnerability stems from a logic flaw in crypto/ssh's ServerConfig.PublicKeyCallback. When an application's callback approves a public key, but subsequent authentication fails, the flaw may still incorrectly authorize the connection. This bypasses intended authentication checks, allowing unauthorized access.
Impact and Risks for your Infrastructure
The primary impact is an unauthorized SSH authentication bypass. Attackers can gain access to Go-based SSH servers using any public key, even if not properly authorized. This can lead to full system compromise, data exfiltration, or further network penetration.
Step-by-Step Mitigation Guide
To mitigate, upgrade your Go applications to Go 1.22.10+ or Go 1.23.4+. Verify the update by checking your Go version (`go version`) and ensuring all dependencies are rebuilt. Re-deploy affected services to apply the fix effectively.
- 1Upgrade Go to 1.22.10+ or 1.23.4+.
- 2Review your PublicKeyCallback implementation to ensure it rejects unauthorized keys.
- 3Add explicit key allowlist validation inside PublicKeyCallback.
- 4Rotate SSH host keys and audit SSH access logs for anomalies.
- 5Run static analysis (govulncheck) to detect usage of vulnerable patterns.
- 6Pin allowed public keys in your callback rather than relying on post-callback checks.