How to fix CVE-2024-45337 – Step-by-Step Guide
Critical vulnerability CVE-2024-45337 affects Go's crypto/ssh library, allowing unauthorized SSH authentication bypass. This flaw, named "Misuse of ServerConfig.PublicKeyCallback," requires immediate attention to secure Go applications.
What is Go crypto/ssh – Misuse of ServerConfig.PublicKeyCallback?
CVE-2024-45337 stems from a logic flaw in Go's crypto/ssh ServerConfig.PublicKeyCallback. If the callback approves a public key, the server might incorrectly authorize the connection even if subsequent authentication steps fail. This bypasses intended authentication, allowing unauthorized access.
Impact and Risks for your Infrastructure
This critical vulnerability enables unauthorized SSH authentication bypass in affected Go applications. Attackers can gain access to SSH servers by presenting any public key, potentially leading to full system compromise, data exfiltration, or service disruption.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-45337, update your Go applications to Go 1.22.10+ or Go 1.23.4+. Verify the update by checking your Go version and recompiling affected services. Ensure your PublicKeyCallback implementation correctly handles authentication failures.
- 1Upgrade Go to 1.22.10+ or 1.23.4+.
- 2Review your PublicKeyCallback implementation to ensure it rejects unauthorized keys.
- 3Add explicit key allowlist validation inside PublicKeyCallback.
- 4Rotate SSH host keys and audit SSH access logs for anomalies.
- 5Run static analysis (govulncheck) to detect usage of vulnerable patterns.
- 6Pin allowed public keys in your callback rather than relying on post-callback checks.