VDB
RHSA-2025%3A0370
RHSA-2025%3A0370
PUBLISHED
CVSS 8.199999809265137 HIGH
A flaw was found in the x/crypto/ssh go library. Applications and libraries that misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. For example, an attacker may send public keys A and B and authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B, for which the attacker does not control the private key. The misuse of ServerConfig.PublicKeyCallback may cause an authorization bypass.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cb2e6a39d5f5fbf3833625dacd8fb4234a9cf46a75c0b753598c7b0dabf723f0_amd64 as a component of Red Hat OpenShift distributed tracing 3.4 | * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:83d835b3df0353b3bce10c55df5cf6eeaee02fdf25c1c7c1151151598d14b90a_arm64 as a component of Red Hat OpenShift distributed tracing 3.4 | * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:3a32097ceb8a30fdb9328b8139028b6ecc6f1a63ce663c93a94796d8f381d094_ppc64le as a component of Red Hat OpenShift distributed tracing 3.4 | *, registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:3a32097ceb8a30fdb9328b8139028b6ecc6f1a63ce663c93a94796d8f381d094_ppc64le, * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:b6cf020d7a4fd54d1196da1b5d6362d2318fa28d0ce24307f77214c9c0796962_amd64 as a component of Red Hat OpenShift distributed tracing 3.4 | *, registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:b6cf020d7a4fd54d1196da1b5d6362d2318fa28d0ce24307f77214c9c0796962_amd64, * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:b6cf020d7a4fd54d1196da1b5d6362d2318fa28d0ce24307f77214c9c0796962_amd64 as a component of Red Hat OpenShift distributed tracing 3.4 | * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:7682ca488e66e62939d079730565ba1c7c6bf7b80ced478dad68bb22ec1daca8_ppc64le as a component of Red Hat OpenShift distributed tracing 3.4 | registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:7682ca488e66e62939d079730565ba1c7c6bf7b80ced478dad68bb22ec1daca8_ppc64le, *, * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:a29ae4d725a82e622644cfa3a133f1599f79a1f3fda5d3d0ed677243b7cc55ca_s390x as a component of Red Hat OpenShift distributed tracing 3.4 | registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:a29ae4d725a82e622644cfa3a133f1599f79a1f3fda5d3d0ed677243b7cc55ca_s390x |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:258ce27da831a29ebbafbf1a6c0432f7ba4a8ee5c129ee22ff3c7746244ebbfe_arm64 as a component of Red Hat OpenShift distributed tracing 3.4 | *, *, * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:46bf0de18572f6930840bd578e329e81d53066b5000fbeed7219676675c9d51d_s390x as a component of Red Hat OpenShift distributed tracing 3.4 | registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:46bf0de18572f6930840bd578e329e81d53066b5000fbeed7219676675c9d51d_s390x |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:a29ae4d725a82e622644cfa3a133f1599f79a1f3fda5d3d0ed677243b7cc55ca_s390x as a component of Red Hat OpenShift distributed tracing 3.4 | *, *, registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:a29ae4d725a82e622644cfa3a133f1599f79a1f3fda5d3d0ed677243b7cc55ca_s390x |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:e1acce6898ac6aa79d3fd4d7cbec12f48ef61e84339d87d9e33499796f566da3_s390x as a component of Red Hat OpenShift distributed tracing 3.4 | *, *, registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:e1acce6898ac6aa79d3fd4d7cbec12f48ef61e84339d87d9e33499796f566da3_s390x |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:4660dc63a61e5711ba75e99f85cad1a120d555ba1a877cb19523ebe6b370ab85_ppc64le as a component of Red Hat OpenShift distributed tracing 3.4 | *, *, * |
| Red Hat | opentelemetry-target-allocator | |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:f30f739a0335ac75001da6b1559ea1ac14290ed1abbaa93cb0a3fd2738ae4160_amd64 as a component of Red Hat OpenShift distributed tracing 3.4 | registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:f30f739a0335ac75001da6b1559ea1ac14290ed1abbaa93cb0a3fd2738ae4160_amd64 |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:3a32097ceb8a30fdb9328b8139028b6ecc6f1a63ce663c93a94796d8f381d094_ppc64le as a component of Red Hat OpenShift distributed tracing 3.4 | registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:3a32097ceb8a30fdb9328b8139028b6ecc6f1a63ce663c93a94796d8f381d094_ppc64le |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:90e354d25291d0c312a6cbfeb66c5746d93fa76ba992ba969db5ce9f61f730d5_arm64 as a component of Red Hat OpenShift distributed tracing 3.4 | registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:90e354d25291d0c312a6cbfeb66c5746d93fa76ba992ba969db5ce9f61f730d5_arm64, *, * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:f30f739a0335ac75001da6b1559ea1ac14290ed1abbaa93cb0a3fd2738ae4160_amd64 as a component of Red Hat OpenShift distributed tracing 3.4 | *, registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:f30f739a0335ac75001da6b1559ea1ac14290ed1abbaa93cb0a3fd2738ae4160_amd64, * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:4c292ceb06bee218911c4325a25efafdb5f82d4ae1d4298fb1ed025183e31eb6_amd64 as a component of Red Hat OpenShift distributed tracing 3.4 | registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:4c292ceb06bee218911c4325a25efafdb5f82d4ae1d4298fb1ed025183e31eb6_amd64, *, * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cb2e6a39d5f5fbf3833625dacd8fb4234a9cf46a75c0b753598c7b0dabf723f0_amd64 as a component of Red Hat OpenShift distributed tracing 3.4 | registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cb2e6a39d5f5fbf3833625dacd8fb4234a9cf46a75c0b753598c7b0dabf723f0_amd64, *, * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:7682ca488e66e62939d079730565ba1c7c6bf7b80ced478dad68bb22ec1daca8_ppc64le as a component of Red Hat OpenShift distributed tracing 3.4 | * |
…and 7 more
Timeline
- Jan 16, 2025 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Jul 19, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:0370 advisory
- https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/red_hat_build_of_opentelemetry advisory
- https://access.redhat.com/security/cve/CVE-2024-45337 advisory
- https://access.redhat.com/security/cve/CVE-2024-45338 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0370.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2331720 issue
- https://www.cve.org/CVERecord?id=CVE-2024-45337 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45337 advisory
- https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909 advisory
- https://go.dev/cl/635315 advisory
- https://go.dev/issue/70779 advisory
- https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ advisory
- https://pkg.go.dev/vuln/GO-2024-3321 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2333122 issue
- https://www.cve.org/CVERecord?id=CVE-2024-45338 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45338 advisory
- https://go.dev/cl/637536 advisory
- https://go.dev/issue/70906 advisory
- https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ advisory
- https://pkg.go.dev/vuln/GO-2024-3333 advisory