pkg.go.dev Open in urlscan Pro
2600:1901:0:f535::  Public Scan

Form analysis
3 forms found in the DOM

/search

<form class="go-InputGroup go-ShortcutKey go-SearchForm-form" action="/search" data-shortcut="/" data-shortcut-alt="search" data-gtmc="search form" aria-label="Search for a package" role="search">
  <input name="q" class="go-Input js-searchFocus" aria-label="Search for a package" type="search" autocapitalize="off" autocomplete="off" autocorrect="off" spellcheck="false" placeholder="Search packages or symbols" value="">
  <input name="m" value="" hidden="">
  <button class="go-Button go-Button--inverted" aria-label="Submit search">
    <img class="go-Icon" height="24" width="24" src="/static/shared/icon/search_gm_grey_24dp.svg" alt="">
  </button>
</form>

DIALOG

<form method="dialog" data-gmtc="jump to form" aria-label="Jump to Identifier">
  <div class="Dialog-title go-Modal-header">
    <h2>Jump to</h2>
    <button class="go-Button go-Button--inline" type="button" data-modal-close="" data-gtmc="modal button" aria-label="Close">
      <img class="go-Icon" height="24" width="24" src="/static/shared/icon/close_gm_grey_24dp.svg" alt="">
    </button>
  </div>
  <div class="JumpDialog-filter">
    <input class="JumpDialog-input go-Input" autocomplete="off" type="text">
  </div>
  <div class="JumpDialog-body go-Modal-body">
    <div class="JumpDialog-list"></div>
  </div>
  <div class="go-Modal-actions">
    <button class="go-Button" data-test-id="close-dialog">Close</button>
  </div>
</form>

DIALOG

<form method="dialog">
  <div class="go-Modal-header">
    <h2>Keyboard shortcuts</h2>
    <button class="go-Button go-Button--inline" type="button" data-modal-close="" data-gtmc="modal button" aria-label="Close">
      <img class="go-Icon" height="24" width="24" src="/static/shared/icon/close_gm_grey_24dp.svg" alt="">
    </button>
  </div>
  <div class="go-Modal-body">
    <table>
      <tbody>
        <tr>
          <td class="ShortcutsDialog-key">
            <strong>?</strong>
          </td>
          <td> : This menu</td>
        </tr>
        <tr>
          <td class="ShortcutsDialog-key">
            <strong>/</strong>
          </td>
          <td> : Search site</td>
        </tr>
        <tr>
          <td class="ShortcutsDialog-key">
            <strong>f</strong> or <strong>F</strong>
          </td>
          <td> : Jump to</td>
        </tr>
        <tr>
          <td class="ShortcutsDialog-key"><strong>y</strong> or <strong>Y</strong></td>
          <td> : Canonical URL</td>
        </tr>
      </tbody>
    </table>
  </div>
  <div class="go-Modal-actions">
    <button class="go-Button" data-test-id="close-dialog">Close</button>
  </div>
</form>

Text Content

Skip to Main Content
 * Why Go
   * Case Studies
     
     Common problems companies solve with Go
   
   * Use Cases
     
     Stories about how and why companies use Go
   
   * Security Policy
     
     How Go can help keep you secure by default
 * Learn
 * Docs
   * Effective Go
     
     Tips for writing clear, performant, and idiomatic Go code
   
   * Go User Manual
     
     A complete introduction to building software with Go
   
   * Standard library
     
     Reference documentation for Go's standard library
   
   * Release Notes
     
     Learn what's new in each Go release
 * Packages
 * Community
   * Recorded Talks
     
     Videos from prior events
   
   * Meetups
     
     Meet other local Go developers
   
   * Conferences
     
     Learn and network with Go developers from around the world
   
   * Go blog
     
     The Go project's official blog.
   
   * Go project
     
     Get help and stay informed from Go
   
   * Get connected
     
     
     
     

 * Why Go
   Why Go
    * Case Studies
    * Use Cases
    * Security Policy

 * Learn
 * Docs
   Docs
    * Effective Go
    * Go User Manual
    * Standard library
    * Release Notes

 * Packages
 * Community
   Community
    * Recorded Talks
    * Meetups
    * Conferences
    * Go blog
    * Go project
    * Get connected
      


 1. Vulnerability Database
 2. All Reports
 3. GO-2024-3321


VULNERABILITY REPORT: GO-2024-3321

 * CVE-2024-45337, GHSA-v778-237x-gjrc
 * Affects: golang.org/x/crypto
 * Published: Dec 11, 2024
 * Modified: Dec 12, 2024

Applications and libraries which misuse the ServerConfig.PublicKeyCallback
callback may be susceptible to an authorization bypass. The documentation for
ServerConfig.PublicKeyCallback says that "A call to this function does not
guarantee that the key offered is in fact used to authenticate." Specifically,
the SSH protocol allows clients to inquire about whether a public key is
acceptable before proving control of the corresponding private key.
PublicKeyCallback may be called with multiple keys, and the order in which the
keys were provided cannot be used to infer which key the client successfully
authenticated with, if any. Some applications, which store the key(s) passed to
PublicKeyCallback (or derived information) and make security relevant
determinations based on it once the connection is established, may make
incorrect assumptions. For example, an attacker may send public keys A and B,
and then authenticate with A. PublicKeyCallback would be called only twice,
first with A and then with B. A vulnerable application may then make
authorization decisions based on key B for which the attacker does not actually
control the private key. Since this API is widely misused, as a partial
mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when
successfully authenticating via public key, the last key passed to
ServerConfig.PublicKeyCallback will be the key used to authenticate the
connection. PublicKeyCallback will now be called multiple times with the same
key, if necessary. Note that the client may still not control the last key
passed to PublicKeyCallback if the connection is then authenticated with a
different method, such as PasswordCallback, KeyboardInteractiveCallback, or
NoClientAuth. Users should be using the Extensions field of the Permissions
return value from the various authentication callbacks to record data associated
with the authentication attempt instead of referencing external state. Once the
connection is established the state corresponding to the successful
authentication attempt can be retrieved via the ServerConn.Permissions field.
Note that some third-party libraries misuse the Permissions type by sharing it
across authentication attempts; users of third-party libraries should refer to
the relevant projects for guidance.


AFFECTED PACKAGES

 * Path
   Go Versions
   Symbols
 * golang.org/x/crypto/ssh
   before v0.31.0
    * ServerConfig.PublicKeyCallback


ALIASES

 * CVE-2024-45337
 * GHSA-v778-237x-gjrc


REFERENCES

 * https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909
 * https://go.dev/cl/635315
 * https://go.dev/issue/70779
 * https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ
 * https://vuln.go.dev/ID/GO-2024-3321.json


CREDITS

 * Damien Tournoud (Platform.sh / Upsun), Patrick Dawkins (Platform.sh / Upsun),
   Vince Parker (Platform.sh / Upsun), Jules Duvivier (Platform.sh / Upsun)


FEEDBACK

See anything missing or incorrect? Suggest an edit to this report.
Why Go Use Cases Case Studies
Get Started Playground Tour Stack Overflow Help
Packages Standard Library Sub-repositories About Go Packages
About Download Blog Issue Tracker Release Notes Brand Guidelines Code of Conduct
Connect Twitter GitHub Slack r/golang Meetup Golang Weekly
 * Copyright
 * Terms of Service
 * Privacy Policy
 * Report an Issue

 * Theme Toggle

 * Shortcuts Modal


JUMP TO



Close


KEYBOARD SHORTCUTS

? : This menu / : Search site f or F : Jump to y or Y : Canonical URL

Close
go.dev uses cookies from Google to deliver and enhance the quality of its
services and to analyze traffic. Learn more.
Okay