How to fix CVE-2024-45337 – Step-by-Step Guide
CVE-2024-45337 addresses a critical vulnerability (CVSS 9.1) in the Go standard library's `crypto/ssh` package. This flaw, named "Misuse of ServerConfig.PublicKeyCallback," could lead to unauthorized access to Go applications. It impacts Go versions prior to 1.22.10 and 1.23.4.
What is Go crypto/ssh – Misuse of ServerConfig.PublicKeyCallback?
The vulnerability stems from a logic flaw in `crypto/ssh`'s authentication flow. Applications using `ServerConfig.PublicKeyCallback` may incorrectly authorize connections even when the callback approves a public key but the subsequent authentication fails. This bypasses intended security checks, allowing unauthorized access.
Impact and Risks for your Infrastructure
This critical flaw enables unauthorized SSH authentication bypass in vulnerable Go applications. Attackers can exploit this by authenticating to SSH servers using any public key, provided the `PublicKeyCallback` is improperly implemented. This could grant full access to affected systems.
Step-by-Step Mitigation Guide
To remediate CVE-2024-45337, update your Go environment to version 1.22.10 or later, or 1.23.4 or later. Verify the fix by recompiling and redeploying affected applications, ensuring they use the patched `crypto/ssh` library. This update resolves the underlying logic flaw.
- 1Upgrade Go to 1.22.10+ or 1.23.4+.
- 2Review your PublicKeyCallback implementation to ensure it rejects unauthorized keys.
- 3Add explicit key allowlist validation inside PublicKeyCallback.
- 4Rotate SSH host keys and audit SSH access logs for anomalies.
- 5Run static analysis (govulncheck) to detect usage of vulnerable patterns.
- 6Pin allowed public keys in your callback rather than relying on post-callback checks.