From 8b5274cf687fd9316b4108863654cc57385531e8 Mon Sep 17 00:00:00 2001 From: Roland Shoemaker Date: Wed, 16 Dec 2020 10:17:34 -0800 Subject: [PATCH] ssh: disallow gssapi-with-mic if GSSAPIWithMICConfig is not set The ability to trigger the 'gssapi-with-mic' authentication method is not properly gated by the presence of the GSSAPIWithMICConfig field of the ServerConfig type. If this field is not set and a client sends a 'gssapi-with-mic' request, regardless of if the server advertises it, the server will panic. This issue was discovered and reported by Joern Schneewesiz, GitLab Security Research Team. Fixes CVE-2020-29652 Change-Id: Ie25de2766e442c8ab46680aae3ac89b0823cdeed Reviewed-on: https://go-review.googlesource.com/c/crypto/+/278852 Trust: Roland Shoemaker Run-TryBot: Roland Shoemaker Reviewed-by: Filippo Valsorda TryBot-Result: Go Bot --- ssh/server.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ssh/server.go b/ssh/server.go index 7d42a8c..b6911e8 100644 --- a/ssh/server.go +++ b/ssh/server.go @@ -572,6 +572,10 @@ userAuthLoop: perms = candidate.perms } case "gssapi-with-mic": + if config.GSSAPIWithMICConfig == nil { + authErr = errors.New("ssh: gssapi-with-mic auth not configured") + break + } gssapiConfig := config.GSSAPIWithMICConfig userAuthRequestGSSAPI, err := parseGSSAPIPayload(userAuthReq.Payload) if err != nil {