Man-in-the-Middle (MitM) attack in crypto - CVE-2017-3204

Vulnerability identifier: #VU69451

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-3204

CWE-ID: CWE-300

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to Go Crypto library does not verify host keys. A remote attacker can perform MitM attack.

crypto
Terraform Provider for PowerStore
Terraform Provider for Redfish
IBM Watson Machine Learning Accelerator
IBM CICS TX Standard
IBM CICS TX Advanced

Install updates from vendor's website.

crypto - update to 0.1.0
Terraform Provider for PowerStore - update to 1.1.2
Terraform Provider for Redfish - update to 1.2.0
IBM Watson Machine Learning Accelerator - update to 2.3.9
IBM CICS TX Standard - update to 11.1.0.0 ifix5
IBM CICS TX Advanced - update to 11.1.0.0 ifix5

• https://bridge.grumpy-troll.org/2017/04/golang-ssh-security/
• https://github.com/golang/crypto/commit/e4e2799dd7aab89f583e1d898300d96367750991
• https://github.com/golang/go/issues/19767
• https://godoc.org/golang.org/x/crypto/ssh

• MitM attack in Go Crypto
• IBM CICS TX update for golang
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in Dell Terraform Provider for PowerStore
• Multiple vulnerabilities in Dell Terraform Provider for Redfish