VDB
RHSA-2025%3A0851
RHSA-2025%3A0851
PUBLISHED
CVSS 8.199999809265137 HIGH
A flaw was found in the x/crypto/ssh go library. Applications and libraries that misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. For example, an attacker may send public keys A and B and authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B, for which the attacker does not control the private key. The misuse of ServerConfig.PublicKeyCallback may cause an authorization bypass.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | rhacm2/governance-policy-propagator-rhel9@sha256:095375bb5a3ddd5bd47f92990455ac3a4fa7e73ae1707ebf09e6ebc9b2789f5c_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | *, *, * |
| Red Hat | rhacm2/acm-must-gather-rhel9@sha256:f8f3aa7d15601aae9e51eb7b465fc94b94bb51efd7534e796bdae1b66ba21aac_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | *, *, * |
| Red Hat | rhacm2/acm-search-v2-rhel9@sha256:2fec4324fd3867f7f43a8b7c5666e016cce6fffa165ea47a5e136539a1c474f9_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | rhacm2/acm-search-v2-rhel9@sha256:2fec4324fd3867f7f43a8b7c5666e016cce6fffa165ea47a5e136539a1c474f9_s390x, *, * |
| Red Hat | rhacm2/prometheus-alertmanager-rhel9@sha256:f5a27df45167b4bb30166f5c8855397d0b6532c71418f5ee42099eb1e88be462_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | rhacm2/prometheus-alertmanager-rhel9@sha256:f5a27df45167b4bb30166f5c8855397d0b6532c71418f5ee42099eb1e88be462_ppc64le |
| Red Hat | rhacm2/console-rhel9@sha256:edf30af9fdfddb3d84afe0b16a6cc9ff7497329c3993af2aac5211776f0667d5_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | *, *, * |
| Red Hat | rhacm2/acm-cluster-permission-rhel9@sha256:5b29efce8fb958632ce3f54e45739b2a7d5ba8f5bc500a793e14250b5fcb6a5d_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | rhacm2/acm-cluster-permission-rhel9@sha256:5b29efce8fb958632ce3f54e45739b2a7d5ba8f5bc500a793e14250b5fcb6a5d_ppc64le |
| Red Hat | rhacm2/acm-prometheus-config-reloader-rhel9@sha256:71416b5170dd7acff7e3dc339009bc84020e13e728c6f7025368e8799c015388_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | rhacm2/acm-prometheus-config-reloader-rhel9@sha256:71416b5170dd7acff7e3dc339009bc84020e13e728c6f7025368e8799c015388_amd64, *, * |
| Red Hat | rhacm2/config-policy-controller-rhel9@sha256:481df173015ff3bd6482d3a0543ec4dfae1115cf2442f82ff4a490888df11388_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | rhacm2/config-policy-controller-rhel9@sha256:481df173015ff3bd6482d3a0543ec4dfae1115cf2442f82ff4a490888df11388_ppc64le |
| Red Hat | rhacm2/acm-cluster-permission-rhel9@sha256:67523fe9d57b858ec237f403c2f294dd6524769759bfc28e0f32cf010ac7125d_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | rhacm2/acm-cluster-permission-rhel9@sha256:67523fe9d57b858ec237f403c2f294dd6524769759bfc28e0f32cf010ac7125d_amd64 |
| Red Hat | rhacm2/observatorium-rhel9@sha256:65e027f1d01b202dbcbc4c970cca930890ab4224a71328f76f65bce8697b63be_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | rhacm2/observatorium-rhel9@sha256:65e027f1d01b202dbcbc4c970cca930890ab4224a71328f76f65bce8697b63be_s390x, *, * |
| Red Hat | rhacm2/multicloud-integrations-rhel9@sha256:94b5afe65f61e5c5fc8ca4702b76c09f55eaa8579ffb49584cd4e5c1c25a3a2d_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | rhacm2/multicloud-integrations-rhel9@sha256:94b5afe65f61e5c5fc8ca4702b76c09f55eaa8579ffb49584cd4e5c1c25a3a2d_amd64 |
| Red Hat | rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:41f5414e661779d0833015b0b8c65316c0ab7a382c9c6fbb24a871e9834726be_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:41f5414e661779d0833015b0b8c65316c0ab7a382c9c6fbb24a871e9834726be_arm64 |
| Red Hat | rhacm2/prometheus-rhel9@sha256:52987b274c1a81d83b71b5955869542f0346e864371329de01ac113ca0157fd3_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | *, *, rhacm2/prometheus-rhel9@sha256:52987b274c1a81d83b71b5955869542f0346e864371329de01ac113ca0157fd3_amd64 |
| Red Hat | rhacm2/acm-multicluster-observability-addon-rhel9@sha256:dcd36b9baee8111f44da2968c44d2d77a3e4379390283b616161768a7b6c52d3_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | rhacm2/acm-multicluster-observability-addon-rhel9@sha256:dcd36b9baee8111f44da2968c44d2d77a3e4379390283b616161768a7b6c52d3_amd64, *, * |
| Red Hat | rhacm2/observatorium-rhel9-operator@sha256:851d0df8d75fb8a0ad2875ec6f8547d8593f4c74b3270dffb91176fe26ba28e7_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | *, *, rhacm2/observatorium-rhel9-operator@sha256:851d0df8d75fb8a0ad2875ec6f8547d8593f4c74b3270dffb91176fe26ba28e7_ppc64le |
| Red Hat | rhacm2/kube-state-metrics-rhel9@sha256:53b4b1b3d862412e157c991d7bd1d2a642dcaed6d50459b1186facdcad6641fa_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | *, *, * |
| Red Hat | rhacm2/submariner-addon-rhel9@sha256:1d882480e5664e877285c2ff542ca4ac6e663514bf9d9a6410b92c3c43de4053_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | *, *, * |
| Red Hat | rhacm2/klusterlet-addon-controller-rhel9@sha256:d82542505423f98e7ee6117a41bae27b31dd420ba41f48009a09039c88d18f8d_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | *, *, * |
| Red Hat | rhacm2/memcached-exporter-rhel9@sha256:98d5a1c73503c406c4e57a0cfd81173cbeaf8a93e905a3fbb96bcf17aebf07a6_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | *, *, * |
| Red Hat | rhacm2/multicloud-integrations-rhel9@sha256:ee42822ff503708836164024d87e3d61454e2e0ce4209fb6d3ac65eeb25a62e6_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | rhacm2/multicloud-integrations-rhel9@sha256:ee42822ff503708836164024d87e3d61454e2e0ce4209fb6d3ac65eeb25a62e6_s390x |
…and 349 more
Timeline
- Jan 30, 2025 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Jul 19, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:0851 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/release_notes/ advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2331063 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2331720 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2333122 issue
- https://issues.redhat.com/browse/ACM-15056 advisory
- https://issues.redhat.com/browse/ACM-15394 advisory
- https://issues.redhat.com/browse/ACM-15525 advisory
- https://issues.redhat.com/browse/ACM-16019 advisory
- https://issues.redhat.com/browse/ACM-16211 advisory
- https://issues.redhat.com/browse/ACM-16517 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0851.json advisory
- https://access.redhat.com/security/cve/CVE-2024-45337 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-45337 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45337 advisory
- https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909 advisory
- https://go.dev/cl/635315 advisory
- https://go.dev/issue/70779 advisory
- https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ advisory
…and 14 more