VDB

GHSA-V778-237X-GJRC

GHSA-V778-237X-GJRC PUBLISHED CVSS 9.100000381469727 CRITICAL

Record from GitHub Advisory Database · Published December 11, 2024

Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
ghChainguard2.63.2-r1
gatekeeper-3.16Chainguard3.16.3-r9
tigera-operator-1.36Chainguard1.36.3-r1
step-issuerChainguard0.9.6-r1
kialiWolfi2.2.0-r1
spqrWolfi2.1.0-r1
k3sWolfi1.32.4.1-r1
podman-fipsChainguard5.3.1-r1
sql_exporter-fipsChainguard0.16.0-r1
kube-rbac-proxy-fipsChainguard0.18.2-r1
local-path-provisionerWolfi0.0.30-r1
gomplateChainguard4.2.0-r1

88 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1
9.100000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

VendorProductVersions
chainguardgh0
chainguardgatekeeper-3.160
chainguardtigera-operator-1.360
chainguardstep-issuer0
wolfikiali0
wolfispqr0
wolfik3s0
chainguardpodman-fips0
chainguardsql_exporter-fips0
chainguardkube-rbac-proxy-fips0
wolfilocal-path-provisioner0
chainguardgomplate0
chainguardflannel0
wolfimkcert0
wolfivendir0
chainguardprometheus-fips-2.540
chainguardtigera-operator-fips-1.340
chainguardslsa-verifier0
chainguardkubevela0
chainguardconsul-k8s-fips-1.50

…and 1276 more

Timeline

  • Dec 11, 2024 CVE Published
  • Apr 30, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-V778-237X-GJRC
vulnetix vdb fixes GHSA-V778-237X-GJRC

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-V778-237X-GJRC/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›