How to fix CVE-2024-45337 – Step-by-Step Guide
CVE-2024-45337 is a critical vulnerability in the Go crypto/ssh standard library, published on 2024-12-11 with a CVSS score of 9.1. It impacts applications that utilize the ServerConfig.PublicKeyCallback for SSH authentication. This flaw can lead to unauthorized access to affected SSH servers.
What is Go crypto/ssh – Misuse of ServerConfig.PublicKeyCallback?
This vulnerability stems from a logic flaw within the Go crypto/ssh library's authentication flow. Applications using ServerConfig.PublicKeyCallback can incorrectly authorize connections. Even if the callback approves a public key, a subsequent authentication failure can still result in an unauthorized bypass, granting access despite intended security checks.
Impact and Risks for your Infrastructure
The primary impact is an unauthorized SSH authentication bypass, allowing attackers to gain access to vulnerable Go applications. This could lead to full system compromise, data exfiltration, or further network penetration. Businesses face significant risks including data breaches, operational disruption, and reputational damage.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-45337, update your Go environment to version 1.22.10 or later, or 1.23.4 or later. Rebuild all applications that use the crypto/ssh package with the patched Go version. Verify the fix by checking your Go version and ensuring your deployments are using the updated binaries.
- 1Upgrade Go to 1.22.10+ or 1.23.4+.
- 2Review your PublicKeyCallback implementation to ensure it rejects unauthorized keys.
- 3Add explicit key allowlist validation inside PublicKeyCallback.
- 4Rotate SSH host keys and audit SSH access logs for anomalies.
- 5Run static analysis (govulncheck) to detect usage of vulnerable patterns.
- 6Pin allowed public keys in your callback rather than relying on post-callback checks.