Описание
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.
Ссылки
- Issue Tracking
- Issue Tracking
- Mailing List
- Vendor Advisory
Уязвимые конфигурации
EPSS
6.3 Medium
CVSS3
8.8 High
CVSS3
Дефекты
Связанные уязвимости
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.
Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
When an SSH server authentication callback returned PartialSuccessErro ...
golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions
EPSS
6.3 Medium
CVSS3
8.8 High
CVSS3