tree 0183928d2fafb2f715756a35d986eeae89f39afa
parent 5f87f3452ae96c4850ab9af7783f2517b643061b
author Roland Shoemaker <roland@golang.org> 1608142654 -0800
committer Roland Shoemaker <roland@golang.org> 1608157849 +0000

ssh: disallow gssapi-with-mic if GSSAPIWithMICConfig is not set

The ability to trigger the 'gssapi-with-mic' authentication method is
not properly gated by the presence of the GSSAPIWithMICConfig field of
the ServerConfig type. If this field is not set and a client sends a
'gssapi-with-mic' request, regardless of if the server advertises it,
the server will panic.

This issue was discovered and reported by Joern Schneewesiz, GitLab
Security Research Team.

Fixes CVE-2020-29652

Change-Id: Ie25de2766e442c8ab46680aae3ac89b0823cdeed
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/278852
Trust: Roland Shoemaker <roland@golang.org>
Run-TryBot: Roland Shoemaker <roland@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>