GO-2023-2402
Man-in-the-middle attacker can compromise integrity of secure channel in golang.org/x/crypto
At a glance
- Published
- Updated
- CVE
- CVE-2023-48795
- Aliases
- GHSA-45x7-px36-x8w8, PYSEC-2026-1758
Description
A protocol weakness allows a MITM attacker to compromise the integrity of the secure channel before it is established, allowing the attacker to prevent transmission of a number of messages immediately after the secure channel is established without either side being aware. The impact of this attack is relatively limited, as it does not compromise confidentiality of the channel. Notably this attack would allow an attacker to prevent the transmission of the SSH2_MSG_EXT_INFO message, disabling a handful of newer security features. This protocol weakness was also fixed in OpenSSH 9.6.
Affected packages
| Package | Versions |
|---|---|
| Go · golang.org/x/crypto | introduced 0, fixed 0.17.0 |
References
- https://go.dev/issue/64784 REPORT
- https://go.dev/cl/550715 FIX
- https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d FIX
- https://groups.google.com/g/golang-announce/c/qA3XtxvMUyg WEB
- https://www.openssh.com/txt/release-9.6 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |