RHSA-2025%3A0444
Record from redhat · Published January 20, 2025
A flaw was found in the x/crypto/ssh go library. Applications and libraries that misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. For example, an attacker may send public keys A and B and authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B, for which the attacker does not control the private key. The misuse of ServerConfig.PublicKeyCallback may cause an authorization bypass.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Trusted Profile Analyzer 1.2.2 | |
| Red Hat | registry.redhat.io/rhtpa/rhtpa-guac-rhel9@sha256:2dc71ee6e8c55a29b6dd68006c7d0365154d35c850021d8b4b77e24b4e8fd1a6_amd64 as a component of Red Hat Trusted Profile Analyzer 1.2 | registry.redhat.io/rhtpa/rhtpa-guac-rhel9@sha256:2dc71ee6e8c55a29b6dd68006c7d0365154d35c850021d8b4b77e24b4e8fd1a6_amd64, * |
| Red Hat | registry.redhat.io/rhtpa/rhtpa-guac-rhel9@sha256:2dc71ee6e8c55a29b6dd68006c7d0365154d35c850021d8b4b77e24b4e8fd1a6_amd64 as a component of Red Hat Trusted Profile Analyzer 1.2 | registry.redhat.io/rhtpa/rhtpa-guac-rhel9@sha256:2dc71ee6e8c55a29b6dd68006c7d0365154d35c850021d8b4b77e24b4e8fd1a6_amd64 |
Timeline
- Jan 20, 2025 CVE Published
- Apr 25, 2026 Security Advisory (5 in total, the first dated here)
- Apr 29, 2026 Distribution Patch (2 in total, the first dated here)
- Jul 19, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln RHSA-2025%3A0444
vulnetix vdb fixes RHSA-2025%3A0444Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/RHSA-2025%253A0444/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://access.redhat.com/security/cve/CVE-2024-45338 advisory
- https://go.dev/issue/70779 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2333122 issue
- https://www.cve.org/CVERecord?id=CVE-2024-45338 advisory
- https://www.cve.org/CVERecord?id=CVE-2025-21613 advisory
- https://pkg.go.dev/vuln/GO-2025-3368 advisory
- https://access.redhat.com/security/cve/CVE-2024-45337 advisory
- https://access.redhat.com/security/cve/CVE-2025-21613 advisory
- https://access.redhat.com/security/cve/CVE-2025-21614 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45337 advisory
- https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ advisory
- https://pkg.go.dev/vuln/GO-2024-3333 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-21613 advisory
- https://pkg.go.dev/vuln/GO-2025-3367 advisory
- https://access.redhat.com/errata/RHSA-2025:0444 advisory
- https://issues.redhat.com/browse/TC-2075 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0444.json advisory
- https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909 advisory
- https://pkg.go.dev/vuln/GO-2024-3321 advisory
…and 19 more