CVE-2017-3204 golang.org/x/crypto/ssh Man-in-the-Middle attack

What is CVE-2017-3204?

CVE-2017-3204 is a high-severity vulnerability in Go SSH library, published on 4 Apr 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism.

Weakness: CWE-310

Which versions are affected by CVE-2017-3204?

3 open source packages ship an affected version, including golang.org/x/crypto. It affects 1 product.

Products include Golang Crypto.

How do I fix CVE-2017-3204?

Upgrade golang.org/x/crypto to 0.0.0-20170330155735-e4e2799dd7aa or later.

Is CVE-2017-3204 being exploited?

There is no known exploitation of CVE-2017-3204 in the wild and no public exploit code.

Other vulnerabilities in Go SSH library

• CVE-2026-46595 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh Critical 10.0
• CVE-2026-39830 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh Critical 9.1
• CVE-2026-39831 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh Critical 9.1
• CVE-2026-39832 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent Critical 9.1
• CVE-2026-39833 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2017-3204, GHSA-xhjq-w7xm-p8qj, GO-2020-0013, UBUNTU-CVE-2017-3204.