1 issue skipped by the security teams:
- CVE-2017-3204: The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/g/golang-go.crypto.png){kind=link}