Go CertChecker Public Key Callback Panic Vulnerability in SSH Servers

A vulnerability exists in SSH servers using CertChecker as a public key callback, specifically in versions of the Go crypto package prior to v0.52.0. If the IsUserAuthority or IsHostAuthority settings are not configured, the server could panic when a client presents a certificate. This issue has been addressed by modifying CertChecker to return an error instead of causing a panic when these authority callbacks are not set.

Impact

Exploitation of this vulnerability leads to a server panic, causing a disruption in the SSH service and potentially affecting all connected users.

Remediation

Users can update to Go version v0.52.0 or later, where this vulnerability has been fixed.