CVE-2024-39223

9.8 CRITICAL

Published: July 03, 2024 Modified: April 15, 2026

Description

An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

https://gist.github.com/nyxfqq/a7242170b1118e78436a62dee4e09e8a

Source: cve@mitre.org

https://github.com/ginuerzh/gost/blob/729d0e70005607dc7c69fc1de62fd8fe21f85355/ssh.go#L229

Source: cve@mitre.org

https://github.com/ginuerzh/gost/issues/1034

Source: cve@mitre.org

https://gist.github.com/nyxfqq/a7242170b1118e78436a62dee4e09e8a

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/ginuerzh/gost/blob/729d0e70005607dc7c69fc1de62fd8fe21f85355/ssh.go#L229

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/ginuerzh/gost/issues/1034

Source: af854a3a-2127-422b-91ae-364da2661108

6 reference(s) from NVD

Quick Stats

CVSS v3 Score

9.8 / 10.0

EPSS (Exploit Probability)

0.1%

20th percentile

Exploitation Status

Not in CISA KEV

Weaknesses (CWE)

CWE-639

Related CVEs