How to fix CVE-2024-45337 – Step-by-Step Guide
CVE-2024-45337 is a critical vulnerability (CVSS 9.1) affecting the Go standard library's crypto/ssh package. It allows for an unauthorized SSH authentication bypass in Go applications. This flaw arises from a logic error in how ServerConfig.PublicKeyCallback is handled.
What is Go crypto/ssh – Misuse of ServerConfig.PublicKeyCallback?
CVE-2024-45337 is a logic flaw in Go's crypto/ssh ServerConfig.PublicKeyCallback. It allows applications to incorrectly authorize SSH connections. This happens when the callback approves a key, but the subsequent authentication fails, creating an authentication bypass. The callback's approval isn't correctly tied to the final authentication outcome.
Impact and Risks for your Infrastructure
The impact is severe: unauthorized SSH authentication bypass in affected Go applications. Attackers can authenticate to SSH servers using any public key, regardless of its validity, if the PublicKeyCallback is improperly implemented. This grants unauthorized access to critical infrastructure and sensitive data, posing a significant risk to system integrity and confidentiality.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-45337, update your Go environment to a fixed version. Upgrade to Go 1.22.10+ or Go 1.23.4+. Verify the update by checking your Go version (`go version`) and recompiling any affected applications to ensure the patched crypto/ssh library is used. This ensures the authentication flow correctly handles PublicKeyCallback.
- 1Upgrade Go to 1.22.10+ or 1.23.4+.
- 2Review your PublicKeyCallback implementation to ensure it rejects unauthorized keys.
- 3Add explicit key allowlist validation inside PublicKeyCallback.
- 4Rotate SSH host keys and audit SSH access logs for anomalies.
- 5Run static analysis (govulncheck) to detect usage of vulnerable patterns.
- 6Pin allowed public keys in your callback rather than relying on post-callback checks.