—

GO-2026-5023

Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

Details

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go / golang.org/x/crypto

Introduced in: 0 Fixed in: 0.52.0

Fix go get golang.org/x/crypto@v0.52.0

References

https://go.dev/issue/79570 [REPORT]
https://groups.google.com/g/golang-announce/c/a082jnz-LvI [WEB]
https://go.dev/cl/781642 [FIX]