Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-39223

Date: July 2, 2024

An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey

Language: Go

Severity Score

Related Resources (7)

https://nvd.nist.gov/vuln/detail/CVE-2024-39223
https://github.com/ginuerzh/gost/blob/729d0e70005607dc7c69fc1de62fd8fe21f85355/ssh.go#L229
https://github.com/advisories/GHSA-8wxx-35qc-vp6r
https://gist.github.com/nyxfqq/a7242170b1118e78436a62dee4e09e8a
https://github.com/ginuerzh/gost/issues/1034
https://github.com/ginuerzh/gost
https://www.mend.io/vulnerability-database/CVE-2024-39223

Severity Score

Weakness Type (CWE)

Authorization Bypass Through User-Controlled Key

CWE-639

Authentication Bypass by Alternate Name

CWE-289

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

Do you need more information?

Contact Us