The vulnerability in golang.org/x/crypto/ssh/agent involves improper preservation of SSH key constraint extensions during key forwarding. Specifically, extensions like [email protected] were not serialized in requests, causing destination restrictions to be silently removed. This allows an attacker to bypass intended security controls by using forwarded keys without the specified restrictions on remote hosts. The in-memory keyring now rejects keys with unsupported constraint extensions instead of ignoring them silently. Red Hat's advisory confirms the vulnerability affects their products that rely on this library for SSH agent key forwarding. No patch or mitigation currently meets Red Hat's deployment and stability criteria.

This vulnerability allows an attacker to bypass SSH key usage restrictions when keys are forwarded via an SSH agent, potentially enabling unauthorized use of SSH keys on remote hosts. The confidentiality and integrity of systems relying on these restrictions can be compromised. There is no known exploitation in the wild at this time. The impact is rated critical with a CVSS score of 9.1, reflecting high confidentiality and integrity impact without availability impact.

According to the Red Hat advisory, no mitigation or patch currently meets their criteria for ease of use, deployment, applicability, or stability. Users should monitor vendor advisories for updates. Until a fix is available, users relying on constraint extensions for limiting SSH key usage should exercise caution when forwarding keys via SSH agents. Engage with Red Hat support or Technical Account Managers for guidance specific to your environment.