From ffd87b4878fa98ca2908ec534e1a410bf095a35e Mon Sep 17 00:00:00 2001 From: Nicola Murino Date: Sun, 25 Jan 2026 15:55:17 +0100 Subject: [PATCH] ssh: fix panic when authority callbacks are nil Previously, if CertChecker.IsHostAuthority or CertChecker.IsUserAuthority were left unset, calling CheckHostKey or Authenticate would result in a nil pointer dereference panic. This change adds checks to ensure these callbacks are defined before invocation, returning an error instead of panicking. This issue was found during a security audit by NCC Group Cryptography Services, sponsored by Teleport. Fixes golang/go#79563 Fixes CVE-2026-39835 Change-Id: I2bd9c8d76646232e49f6aedc7b5334f3825918be Reviewed-on: https://go-review.googlesource.com/c/crypto/+/781660 Commit-Queue: Neal Patel Reviewed-by: Roland Shoemaker LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com Reviewed-by: Neal Patel --- ssh/certs.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ssh/certs.go b/ssh/certs.go index 139fa31..b003234 100644 --- a/ssh/certs.go +++ b/ssh/certs.go @@ -348,6 +348,9 @@ func (c *CertChecker) CheckHostKey(addr string, remote net.Addr, key PublicKey) if cert.CertType != HostCert { return fmt.Errorf("ssh: certificate presented as a host key has type %d", cert.CertType) } + if c.IsHostAuthority == nil { + return errors.New("ssh: cannot verify certificate, IsHostAuthority not set") + } if !c.IsHostAuthority(cert.SignatureKey, addr) { return fmt.Errorf("ssh: no authorities for hostname: %v", addr) } @@ -375,6 +378,9 @@ func (c *CertChecker) Authenticate(conn ConnMetadata, pubKey PublicKey) (*Permis if cert.CertType != UserCert { return nil, fmt.Errorf("ssh: cert has type %d", cert.CertType) } + if c.IsUserAuthority == nil { + return nil, errors.New("ssh: cannot verify certificate, IsUserAuthority not set") + } if !c.IsUserAuthority(cert.SignatureKey) { return nil, fmt.Errorf("ssh: certificate signed by unrecognized authority") }