VDB
RHSA-2025%3A0676
RHSA-2025%3A0676
PUBLISHED
CVSS 8.199999809265137 HIGH
A flaw was found in the x/crypto/ssh go library. Applications and libraries that misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. For example, an attacker may send public keys A and B and authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B, for which the attacker does not control the private key. The misuse of ServerConfig.PublicKeyCallback may cause an authorization bypass.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | multicluster-engine/hypershift-addon-rhel9-operator@sha256:a61896136c7c66d829e85a652730bd498bad4955d797440311270b19ea536d48_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/hypershift-addon-rhel9-operator@sha256:a61896136c7c66d829e85a652730bd498bad4955d797440311270b19ea536d48_ppc64le |
| Red Hat | multicluster-engine/agent-service-rhel8@sha256:12233e3d9e7b38d043c9154ae6a136ecf0bf3018eaa7fdbfe143e607a5a91004_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 8 | multicluster-engine/agent-service-rhel8@sha256:12233e3d9e7b38d043c9154ae6a136ecf0bf3018eaa7fdbfe143e607a5a91004_s390x |
| Red Hat | multicluster-engine/work-rhel9@sha256:17177841295c70fb1fdbe58a356951311f402295c0f7c1da68d5f6fdee7d1fdc_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/work-rhel9@sha256:17177841295c70fb1fdbe58a356951311f402295c0f7c1da68d5f6fdee7d1fdc_s390x |
| Red Hat | multicluster-engine/managed-serviceaccount-rhel9@sha256:20ea99f2687a728509bf1982baf575ae41ebc385e7ba9a51b3380f0efe209969_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/managed-serviceaccount-rhel9@sha256:20ea99f2687a728509bf1982baf575ae41ebc385e7ba9a51b3380f0efe209969_s390x |
| Red Hat | multicluster-engine/discovery-rhel9@sha256:19d3c55cbfe1a3a6ae12105fdf89842b3d1765ac4f675f0f37ec21c7e883530b_amd64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/discovery-rhel9@sha256:19d3c55cbfe1a3a6ae12105fdf89842b3d1765ac4f675f0f37ec21c7e883530b_amd64 |
| Red Hat | multicluster-engine/discovery-rhel9@sha256:9076810900795e6de9c82a280efcfcd258bcda1c1ac212c8becaaf8ac4ec9732_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/discovery-rhel9@sha256:9076810900795e6de9c82a280efcfcd258bcda1c1ac212c8becaaf8ac4ec9732_ppc64le |
| Red Hat | multicluster-engine/hypershift-rhel9-operator@sha256:d7185bd9b439e2cc0b3705b91c40ad4fd7455947f62a978b5038e6beb5491864_amd64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | * |
| Red Hat | multicluster-engine/image-based-install-rhel9@sha256:dc4e3b0b2844fc926592aaefef5a7d61bae8eff34ff1391c97d8ba047bb976e9_arm64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/image-based-install-rhel9@sha256:dc4e3b0b2844fc926592aaefef5a7d61bae8eff34ff1391c97d8ba047bb976e9_arm64 |
| Red Hat | multicluster-engine/apiserver-network-proxy-rhel9@sha256:cbe0ea6421291d4ba10925af3a21ac2b8374d10091635c531b2c5ff7d499a1b6_arm64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/apiserver-network-proxy-rhel9@sha256:cbe0ea6421291d4ba10925af3a21ac2b8374d10091635c531b2c5ff7d499a1b6_arm64 |
| Red Hat | multicluster-engine/cluster-api-provider-aws-rhel9@sha256:4f97aa38578070b493587485511e6f5f35b73c43ef75bd3c325db2dafc669892_arm64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/cluster-api-provider-aws-rhel9@sha256:4f97aa38578070b493587485511e6f5f35b73c43ef75bd3c325db2dafc669892_arm64 |
| Red Hat | multicluster-engine/assisted-installer-agent-rhel8@sha256:99e807ff6393e891ee057e9954efa0b69bcab21df47739a4d064bfdc1ed8c18f_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 8 | multicluster-engine/assisted-installer-agent-rhel8@sha256:99e807ff6393e891ee057e9954efa0b69bcab21df47739a4d064bfdc1ed8c18f_s390x |
| Red Hat | multicluster-engine/backplane-rhel9-operator@sha256:4e8d1b36928e1d1f06ebd5b15d921e6d285ba29cf67dca8254ec4500c08ae89b_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/backplane-rhel9-operator@sha256:4e8d1b36928e1d1f06ebd5b15d921e6d285ba29cf67dca8254ec4500c08ae89b_ppc64le |
| Red Hat | multicluster-engine/aws-encryption-provider-rhel9@sha256:a783f9602f70bd55a7961a2572fb6e676d1f9d5d37bce474e84544d597586c17_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | * |
| Red Hat | multicluster-engine/registration-rhel9@sha256:95a14f06a48aec91b29cd6132af284255bb80a6c47fd3b2c455f0ba70c12f067_arm64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/registration-rhel9@sha256:95a14f06a48aec91b29cd6132af284255bb80a6c47fd3b2c455f0ba70c12f067_arm64 |
| Red Hat | multicluster-engine/placement-rhel9@sha256:8e5a103e06f8fd3a81468921de32895c8dfb8b43add4b596f5b2d82dd702b0df_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | * |
| Red Hat | multicluster-engine/managedcluster-import-controller-rhel9@sha256:82cb538eb44518456d22e76925c1849a39c04023246835a5656d75ae3189d2a5_amd64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/managedcluster-import-controller-rhel9@sha256:82cb538eb44518456d22e76925c1849a39c04023246835a5656d75ae3189d2a5_amd64 |
| Red Hat | multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e5e8151e4ea6fad2127200542a2a20b84d2eb51b0ce92d842c6076735b9517a7_arm64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | * |
| Red Hat | multicluster-engine/managedcluster-import-controller-rhel9@sha256:82cb538eb44518456d22e76925c1849a39c04023246835a5656d75ae3189d2a5_amd64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | multicluster-engine/managedcluster-import-controller-rhel9@sha256:82cb538eb44518456d22e76925c1849a39c04023246835a5656d75ae3189d2a5_amd64 |
| Red Hat | multicluster-engine/apiserver-network-proxy-rhel9@sha256:8f1bca89c4f9bce28f1a75f23fcf12b7261eda6c9f5c1fd326ef2ff93f38ed41_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | * |
| Red Hat | multicluster-engine/multicloud-manager-rhel9@sha256:3e11a388772bb8802c7a0665a324aa52ae3617bd06b46f8e6e2c1f079ef7b12f_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 9 | * |
…and 276 more
Timeline
- Jan 23, 2025 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 30, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:0676 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2331720 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0676.json advisory
- https://access.redhat.com/security/cve/CVE-2024-45337 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-45337 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45337 advisory
- https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909 advisory
- https://go.dev/cl/635315 advisory
- https://go.dev/issue/70779 advisory
- https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ advisory
- https://pkg.go.dev/vuln/GO-2024-3321 advisory