https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T14:35:46.674210+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2022-06638 bdu:2022-06638 2026-10-12T14:35:46.911837+00:00 bdu:2022-06638 https://cve.radiocsirt.org/vuln/cnvd-2017-04720 cnvd-2017-04720 2026-10-12T14:35:46.911876+00:00 cnvd-2017-04720 https://cve.radiocsirt.org/vuln/euvd-2026-72765 EUVD-2026-72765 2026-10-12T14:35:46.911892+00:00 EUVD-2026-72765 https://cve.radiocsirt.org/vuln/fkie_cve-2017-3204 fkie_cve-2017-3204 2026-10-12T14:35:46.911905+00:00

The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism.

 https://cve.radiocsirt.org/vuln/ghsa-xhjq-w7xm-p8qj GHSA-xhjq-w7xm-p8qj — golang.org/x/crypto/ssh Man-in-the-Middle attack 2026-10-12T14:35:46.911937+00:00

Affected: Go: golang.org/x/crypto

The Go SSH library (golang.org/x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks if ClientConfig.HostKeyCallback is not set. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism.

 https://cve.radiocsirt.org/vuln/gsd-2017-3204 gsd-2017-3204 2026-10-12T14:35:46.911963+00:00 gsd-2017-3204 https://cve.radiocsirt.org/vuln/ubuntu-cve-2017-3204 UBUNTU-CVE-2017-3204 2026-10-12T14:35:46.911975+00:00

Affected: Ubuntu:Pro:16.04:LTS: golang-go.crypto, Ubuntu:Pro:16.04:LTS: snapd, Ubuntu:Pro:18.04:LTS: snapd, Ubuntu:Pro:20.04:LTS: snapd, Ubuntu:22.04:LTS: snapd, Ubuntu:24.04:LTS: snapd, Ubuntu:25.10: snapd, Ubuntu:26.04:LTS: snapd

The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism.