CVE-2024-39223

EUVD-2024-2306
An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 19%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
ginuerzhgost
𝑥
≤ 2.11.5
ADP
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
gost
focal
needs-triage
jammy
needs-triage
mantic
ignored
noble
needs-triage
oracular
ignored
plucky
needs-triage
questing
needs-triage
Common Weakness Enumeration
References
https://gist.github.com/nyxfqq/a7242170b1118e78436a62dee4e09e8a
https://github.com/ginuerzh/gost/blob/729d0e70005607dc7c69fc1de62fd8fe21f85355/ssh.go#L229
https://github.com/ginuerzh/gost/issues/1034
https://gist.github.com/nyxfqq/a7242170b1118e78436a62dee4e09e8a
https://github.com/ginuerzh/gost/blob/729d0e70005607dc7c69fc1de62fd8fe21f85355/ssh.go#L229
https://github.com/ginuerzh/gost/issues/1034