Heads-up: Golang SSH CVE-2023-48795
reddit / selfhosted

----------------------------------------------------------------------
ThetaDev256 · 2023-12-17 18:51

According to the developers they found a vulnerablility in Golang's
SSH library.

https://groups.google.com/g/golang-announce/c/-n5WqVC18LQ

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-48795

Currently there are no details known about it, but they plan to
release a fix tomorrow. If you are hosting applications written in Go
which have SSH functionality (for example Gitea/Forgejo) you should
update your application as soon as a patch is released.

----------------------------------------------------------------------
thorntech · 2023-12-18 17:10

Some more details are online now:
https://nvd.nist.gov/vuln/detail/CVE-2023-48795

----------------------------------------------------------------------
ThetaDev256 · 2023-12-19 19:33

Looks like the vulnerability does not only affect Golang but just
about all SSH implementations including OpenSSH

Debian has a nice overview of vulnerable software:
https://security-tracker.debian.org/tracker/CVE-2023-48795