rules:
- id: avoid-ssh-insecure-ignore-host-key
  message: >-
    Disabled host key verification detected. This allows man-in-the-middle
    attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do
    host key verification.
    See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/
    to learn more about the problem and how to fix it.
  metadata:
    cwe:
    - 'CWE-322: Key Exchange without Entity Authentication'
    owasp:
    - A02:2021 - Cryptographic Failures
    source-rule-url: https://github.com/securego/gosec
    references:
    - https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/
    - https://gist.github.com/Skarlso/34321a230cf0245018288686c9e70b2d
    category: security
    technology:
    - go
    confidence: MEDIUM
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
  languages: [go]
  severity: WARNING
  pattern: |-
    ssh.InsecureIgnoreHostKey()