The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Crypto | Golang | * | 2017-03-17 (including) |