VDB
RHSA-2025%3A0386
RHSA-2025%3A0386
PUBLISHED
CVSS 8.199999809265137 HIGH
A flaw was found in the x/crypto/ssh go library. Applications and libraries that misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. For example, an attacker may send public keys A and B and authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B, for which the attacker does not control the private key. The misuse of ServerConfig.PublicKeyCallback may cause an authorization bypass.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | rhacm2/volsync-operator-bundle@sha256:1cec6197368b7d5a9712b89786d2b17185081a53ade8a693557da580686007bc_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/volsync-operator-bundle@sha256:1cec6197368b7d5a9712b89786d2b17185081a53ade8a693557da580686007bc_amd64 |
| Red Hat | rhacm2/volsync-rhel9@sha256:86e1cc2f2abbcf13e1a104b1d985c8d7685a6c66fb6f2770bb38da165a597848_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/volsync-rhel9@sha256:86e1cc2f2abbcf13e1a104b1d985c8d7685a6c66fb6f2770bb38da165a597848_s390x |
| Red Hat | rhacm2/volsync-rhel9@sha256:1cb132539aa8a0ecb5bf395db48306adcb0ec66deec5c257f54c223b721a65bc_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/volsync-rhel9@sha256:1cb132539aa8a0ecb5bf395db48306adcb0ec66deec5c257f54c223b721a65bc_arm64 |
| Red Hat | rhacm2/volsync-rhel9@sha256:6a041d90d24a4463ee7bc08148ec8c1e811c1b02d9028d66e54ba8be479ae13b_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | * |
| Red Hat | rhacm2/volsync-rhel9@sha256:1cb132539aa8a0ecb5bf395db48306adcb0ec66deec5c257f54c223b721a65bc_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | *, rhacm2/volsync-rhel9@sha256:1cb132539aa8a0ecb5bf395db48306adcb0ec66deec5c257f54c223b721a65bc_arm64, * |
| Red Hat | rhacm2/volsync-rhel9@sha256:c619a9bde6e0afce2dde87fcbc27148dc9ccf83f522662499e0031315a731ce3_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/volsync-rhel9@sha256:c619a9bde6e0afce2dde87fcbc27148dc9ccf83f522662499e0031315a731ce3_amd64, *, * |
| Red Hat | rhacm2/volsync-rhel9@sha256:86e1cc2f2abbcf13e1a104b1d985c8d7685a6c66fb6f2770bb38da165a597848_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/volsync-rhel9@sha256:86e1cc2f2abbcf13e1a104b1d985c8d7685a6c66fb6f2770bb38da165a597848_s390x, *, * |
| Red Hat | rhacm2/volsync-rhel9@sha256:c619a9bde6e0afce2dde87fcbc27148dc9ccf83f522662499e0031315a731ce3_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | * |
| Red Hat | rhacm2/volsync-rhel9@sha256:6a041d90d24a4463ee7bc08148ec8c1e811c1b02d9028d66e54ba8be479ae13b_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | *, rhacm2/volsync-rhel9@sha256:6a041d90d24a4463ee7bc08148ec8c1e811c1b02d9028d66e54ba8be479ae13b_ppc64le, * |
| Red Hat | rhacm2/volsync-operator-bundle@sha256:1cec6197368b7d5a9712b89786d2b17185081a53ade8a693557da580686007bc_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/volsync-operator-bundle@sha256:1cec6197368b7d5a9712b89786d2b17185081a53ade8a693557da580686007bc_amd64, *, * |
| Red Hat |
Timeline
- Jan 16, 2025 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Jul 19, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:0386 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2329991 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2331720 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2333122 issue
- https://issues.redhat.com/browse/ACM-16523 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0386.json advisory
- https://access.redhat.com/security/cve/CVE-2024-45337 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-45337 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45337 advisory
- https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909 advisory
- https://go.dev/cl/635315 advisory
- https://go.dev/issue/70779 advisory
- https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ advisory
- https://pkg.go.dev/vuln/GO-2024-3321 advisory
- https://access.redhat.com/security/cve/CVE-2024-45338 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-45338 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45338 advisory
- https://go.dev/cl/637536 advisory
- https://go.dev/issue/70906 advisory
…and 9 more