CVE-2017-3204
CVE
High
· CVSS 8.1
False Positivex/crypto/ssh: Missing Default Host Key Verification Enables Man-in-the-Middle
This advisory does not affect KrakenD
The default was changed in
golang.org/x/crypto in 2017, and every supported KrakenD
release ships a version released years after the fix (KrakenD Enterprise 3.0.3 ships
v0.58.0). Security scanners that report it are mapping the module version incorrectly.
In addition, KrakenD has no SSH functionality, so the SSH client is never used.Component
Go extended library (x/crypto/ssh)
Disclosed
Nov 4, 2026
CVSS Score
8.1
Description
Versions of Go’s
golang.org/x/crypto/ssh package released before March 2017 did not
verify the server host key by default. SSH clients built on the library accepted any
host key unless the application registered a verification callback, which allowed a
man-in-the-middle attacker to impersonate the server. The fix made a host key
verification mechanism mandatory. This does not affect KrakenD.