VDB
RHSA-2025%3A11396
RHSA-2025%3A11396
PUBLISHED
CVSS 8.199999809265137 HIGH
A flaw was found in the x/crypto/ssh go library. Applications and libraries that misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. For example, an attacker may send public keys A and B and authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B, for which the attacker does not control the private key. The misuse of ServerConfig.PublicKeyCallback may cause an authorization bypass.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:d9cc11a9154a89f84d66874f773225b6ac2b9a3342bd4d15cbb2ee8639c5f05f_s390x as a component of 9Base-OADP-1.4 | *, oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:d9cc11a9154a89f84d66874f773225b6ac2b9a3342bd4d15cbb2ee8639c5f05f_s390x, oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:d9cc11a9154a89f84d66874f773225b6ac2b9a3342bd4d15cbb2ee8639c5f05f_s390x |
| Red Hat | oadp/oadp-velero-rhel9@sha256:8f28683c1b38621778de147f3f2329119f843e017d48a33de14fcadfc9f4384b_arm64 as a component of 9Base-OADP-1.4 | oadp/oadp-velero-rhel9@sha256:8f28683c1b38621778de147f3f2329119f843e017d48a33de14fcadfc9f4384b_arm64, oadp/oadp-velero-rhel9@sha256:8f28683c1b38621778de147f3f2329119f843e017d48a33de14fcadfc9f4384b_arm64, oadp/oadp-velero-rhel9@sha256:8f28683c1b38621778de147f3f2329119f843e017d48a33de14fcadfc9f4384b_arm64 |
| Red Hat | oadp/oadp-velero-plugin-rhel9@sha256:b76bf2f89b41f4f5a3fb696a3942f26eb1ffbdf5a0bc0d9611906dd1de177d16_amd64 as a component of 9Base-OADP-1.4 | *, oadp/oadp-velero-plugin-rhel9@sha256:b76bf2f89b41f4f5a3fb696a3942f26eb1ffbdf5a0bc0d9611906dd1de177d16_amd64, * |
| Red Hat | oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f7b3d93c79057eaefd036c8aa06f392487a73c1dde9a5bdecac73610b42461d_arm64 as a component of 9Base-OADP-1.4 | oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f7b3d93c79057eaefd036c8aa06f392487a73c1dde9a5bdecac73610b42461d_arm64, oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f7b3d93c79057eaefd036c8aa06f392487a73c1dde9a5bdecac73610b42461d_arm64, oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:9f7b3d93c79057eaefd036c8aa06f392487a73c1dde9a5bdecac73610b42461d_arm64 |
| Red Hat | oadp/oadp-velero-plugin-for-aws-rhel9@sha256:e97dc347f843eab864efb81f939b425554e6db58cde788a942afd7b00ac470df_s390x as a component of 9Base-OADP-1.4 | oadp/oadp-velero-plugin-for-aws-rhel9@sha256:e97dc347f843eab864efb81f939b425554e6db58cde788a942afd7b00ac470df_s390x, oadp/oadp-velero-plugin-for-aws-rhel9@sha256:e97dc347f843eab864efb81f939b425554e6db58cde788a942afd7b00ac470df_s390x, oadp/oadp-velero-plugin-for-aws-rhel9@sha256:e97dc347f843eab864efb81f939b425554e6db58cde788a942afd7b00ac470df_s390x |
| Red Hat | oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a654a342057e7f679a96a5f18069bf6568e9a9f59f9f1934bf02f346a73cfe25_ppc64le as a component of 9Base-OADP-1.4 | oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a654a342057e7f679a96a5f18069bf6568e9a9f59f9f1934bf02f346a73cfe25_ppc64le, oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a654a342057e7f679a96a5f18069bf6568e9a9f59f9f1934bf02f346a73cfe25_ppc64le, oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:a654a342057e7f679a96a5f18069bf6568e9a9f59f9f1934bf02f346a73cfe25_ppc64le |
| Red Hat | oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aaf2bfc6b4a84f6b56592cfaa63552bea96ac5c8283f883b0f810a4c00b5f469_amd64 as a component of 9Base-OADP-1.4 | oadp/oadp-velero-restic-restore-helper-rhel9@sha256:aaf2bfc6b4a84f6b56592cfaa63552bea96ac5c8283f883b0f810a4c00b5f469_amd64, *, * |
| Red Hat | oadp/oadp-mustgather-rhel9@sha256:41f32fb3b6f3c1ed7be1f2580dd0fcc861c8240c8470b4e0346e0ba5bbb512b5_s390x as a component of 9Base-OADP-1.4 | oadp/oadp-mustgather-rhel9@sha256:41f32fb3b6f3c1ed7be1f2580dd0fcc861c8240c8470b4e0346e0ba5bbb512b5_s390x, oadp/oadp-mustgather-rhel9@sha256:41f32fb3b6f3c1ed7be1f2580dd0fcc861c8240c8470b4e0346e0ba5bbb512b5_s390x, oadp/oadp-mustgather-rhel9@sha256:41f32fb3b6f3c1ed7be1f2580dd0fcc861c8240c8470b4e0346e0ba5bbb512b5_s390x |
| Red Hat | oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:475a27e370e023af9fc2698ce9b14a97cd0302d27f2bc52dc680bb63a82eb707_s390x as a component of 9Base-OADP-1.4 | oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:475a27e370e023af9fc2698ce9b14a97cd0302d27f2bc52dc680bb63a82eb707_s390x, *, oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:475a27e370e023af9fc2698ce9b14a97cd0302d27f2bc52dc680bb63a82eb707_s390x |
| Red Hat | oadp/oadp-mustgather-rhel9@sha256:d9bcac4f030c419292e13e517baf606514dece94182328e9f54058508a5138f1_ppc64le as a component of 9Base-OADP-1.4 | oadp/oadp-mustgather-rhel9@sha256:d9bcac4f030c419292e13e517baf606514dece94182328e9f54058508a5138f1_ppc64le, *, oadp/oadp-mustgather-rhel9@sha256:d9bcac4f030c419292e13e517baf606514dece94182328e9f54058508a5138f1_ppc64le |
| Red Hat | oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:fb57f4b7e2df487e6a8d272168c88ccd2f9f9b4d06efe23cf271c900d84d66cc_arm64 as a component of 9Base-OADP-1.4 | oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:fb57f4b7e2df487e6a8d272168c88ccd2f9f9b4d06efe23cf271c900d84d66cc_arm64, oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:fb57f4b7e2df487e6a8d272168c88ccd2f9f9b4d06efe23cf271c900d84d66cc_arm64, oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:fb57f4b7e2df487e6a8d272168c88ccd2f9f9b4d06efe23cf271c900d84d66cc_arm64 |
| Red Hat | oadp/oadp-velero-plugin-rhel9@sha256:7c3889900001f080690330f619d8e509e7005363a984eeb47221359b91166674_ppc64le as a component of 9Base-OADP-1.4 | *, *, * |
| Red Hat | oadp/oadp-velero-plugin-rhel9@sha256:6fb517f7cba99c4db682a9e71e4afce78f0f6b2b6fed6ee83ee39e3883af72d1_arm64 as a component of 9Base-OADP-1.4 | *, oadp/oadp-velero-plugin-rhel9@sha256:6fb517f7cba99c4db682a9e71e4afce78f0f6b2b6fed6ee83ee39e3883af72d1_arm64, oadp/oadp-velero-plugin-rhel9@sha256:6fb517f7cba99c4db682a9e71e4afce78f0f6b2b6fed6ee83ee39e3883af72d1_arm64 |
| Red Hat | oadp/oadp-mustgather-rhel9@sha256:a0dad19da75a825d5756e033590df8cdb5a6af0f55f906b9b1000d4c3adccd5a_amd64 as a component of 9Base-OADP-1.4 | oadp/oadp-mustgather-rhel9@sha256:a0dad19da75a825d5756e033590df8cdb5a6af0f55f906b9b1000d4c3adccd5a_amd64, *, * |
| Red Hat | oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2cdd8800ab19ff52a6682d3a6477c745b09224998dd4d7c5882111496ae8ec09_amd64 as a component of 9Base-OADP-1.4 | *, *, * |
| Red Hat | oadp/oadp-rhel9-operator@sha256:c64c81ccaa4d3ed1c2b333936b0a9aa111e4dde2de88af5780ebd83f3b29bad6_amd64 as a component of 9Base-OADP-1.4 | oadp/oadp-rhel9-operator@sha256:c64c81ccaa4d3ed1c2b333936b0a9aa111e4dde2de88af5780ebd83f3b29bad6_amd64, *, * |
| Red Hat | oadp/oadp-velero-plugin-for-aws-rhel9@sha256:36a22693fd6d1d2721f2f6d579bc638d51ae3648766cc57118f6956cd10aba36_arm64 as a component of 9Base-OADP-1.4 | oadp/oadp-velero-plugin-for-aws-rhel9@sha256:36a22693fd6d1d2721f2f6d579bc638d51ae3648766cc57118f6956cd10aba36_arm64, *, oadp/oadp-velero-plugin-for-aws-rhel9@sha256:36a22693fd6d1d2721f2f6d579bc638d51ae3648766cc57118f6956cd10aba36_arm64 |
| Red Hat | oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:6c8c1cee0d702a5917c16decf62950adddc5ad4b629492b50a2d3c860dad14c2_ppc64le as a component of 9Base-OADP-1.4 | *, *, oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:6c8c1cee0d702a5917c16decf62950adddc5ad4b629492b50a2d3c860dad14c2_ppc64le |
| Red Hat | oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f78f207306aebfe90a9126218b77b64a088b68122f8805b5b69e47972e5d298a_arm64 as a component of 9Base-OADP-1.4 | oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f78f207306aebfe90a9126218b77b64a088b68122f8805b5b69e47972e5d298a_arm64, oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f78f207306aebfe90a9126218b77b64a088b68122f8805b5b69e47972e5d298a_arm64, oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:f78f207306aebfe90a9126218b77b64a088b68122f8805b5b69e47972e5d298a_arm64 |
| Red Hat | oadp/oadp-rhel9-operator@sha256:e4a7bd1b9aeae7350256a65fcb094cff2622e569ca8768df63d43682dff364d4_arm64 as a component of 9Base-OADP-1.4 | *, *, * |
…and 71 more
Timeline
- Jul 18, 2025 CVE Published
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2025:11396 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2331720 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2333122 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2335888 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2347423 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2348366 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2348367 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2354195 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2358493 issue
- https://issues.redhat.com/browse/OADP-5904 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11396.json advisory
- https://access.redhat.com/security/cve/CVE-2024-45337 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-45337 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45337 advisory
- https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909 advisory
- https://go.dev/cl/635315 advisory
- https://go.dev/issue/70779 advisory
- https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ advisory
- https://pkg.go.dev/vuln/GO-2024-3321 advisory
…and 43 more