VDB
RHSA-2025%3A1327
RHSA-2025%3A1327
PUBLISHED
CVSS 8.199999809265137 HIGH
A flaw was found in the x/crypto/ssh go library. Applications and libraries that misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. For example, an attacker may send public keys A and B and authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B, for which the attacker does not control the private key. The misuse of ServerConfig.PublicKeyCallback may cause an authorization bypass.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhtas/createctconfig-rhel9@sha256:64b594dd719deebed479cbb82522372becbdf4c6a12180d8835d05fc18db4e25_amd64 as a component of Red Hat Trusted Artifact Signer 1.1 | registry.redhat.io/rhtas/createctconfig-rhel9@sha256:64b594dd719deebed479cbb82522372becbdf4c6a12180d8835d05fc18db4e25_amd64 |
| Red Hat | registry.redhat.io/rhtas/fulcio-createcerts-rhel9@sha256:2fae433b5864d63470156d36a07cdda08dde72a3894b2d7912d9ae98dda916c7_amd64 as a component of Red Hat Trusted Artifact Signer 1.1 | * |
| Red Hat | registry.redhat.io/rhtas/tuf-server-rhel9@sha256:313f00c01331f9000ee3a75ffa38327c87adf5b52eeedefe47aca8c8f4b158d1_amd64 as a component of Red Hat Trusted Artifact Signer 1.1 | registry.redhat.io/rhtas/tuf-server-rhel9@sha256:313f00c01331f9000ee3a75ffa38327c87adf5b52eeedefe47aca8c8f4b158d1_amd64 |
| Red Hat | registry.redhat.io/rhtas/ctlog-managectroots-rhel9@sha256:a0f59acb1076abf8abf25f8d90c8c2950f34b05a9586f42491d497353cef050a_amd64 as a component of Red Hat Trusted Artifact Signer 1.1 | registry.redhat.io/rhtas/ctlog-managectroots-rhel9@sha256:a0f59acb1076abf8abf25f8d90c8c2950f34b05a9586f42491d497353cef050a_amd64 |
| Red Hat | registry.redhat.io/rhtas/tuf-server-rhel9@sha256:313f00c01331f9000ee3a75ffa38327c87adf5b52eeedefe47aca8c8f4b158d1_amd64 as a component of Red Hat Trusted Artifact Signer 1.1 | registry.redhat.io/rhtas/tuf-server-rhel9@sha256:313f00c01331f9000ee3a75ffa38327c87adf5b52eeedefe47aca8c8f4b158d1_amd64 |
| Red Hat | registry.redhat.io/rhtas/createctconfig-rhel9@sha256:64b594dd719deebed479cbb82522372becbdf4c6a12180d8835d05fc18db4e25_amd64 as a component of Red Hat Trusted Artifact Signer 1.1 | registry.redhat.io/rhtas/createctconfig-rhel9@sha256:64b594dd719deebed479cbb82522372becbdf4c6a12180d8835d05fc18db4e25_amd64 |
| Red Hat | registry.redhat.io/rhtas/ctlog-managectroots-rhel9@sha256:a0f59acb1076abf8abf25f8d90c8c2950f34b05a9586f42491d497353cef050a_amd64 as a component of Red Hat Trusted Artifact Signer 1.1 | registry.redhat.io/rhtas/ctlog-managectroots-rhel9@sha256:a0f59acb1076abf8abf25f8d90c8c2950f34b05a9586f42491d497353cef050a_amd64 |
| Red Hat | registry.redhat.io/rhtas/trillian-createdb-rhel9@sha256:62c33fbce877199e5352268f9f9229be5051791c639eb2daff823ba3d644ddd1_amd64 as a component of Red Hat Trusted Artifact Signer 1.1 | registry.redhat.io/rhtas/trillian-createdb-rhel9@sha256:62c33fbce877199e5352268f9f9229be5051791c639eb2daff823ba3d644ddd1_amd64 |
| Red Hat | registry.redhat.io/rhtas/fulcio-createcerts-rhel9@sha256:2fae433b5864d63470156d36a07cdda08dde72a3894b2d7912d9ae98dda916c7_amd64 as a component of Red Hat Trusted Artifact Signer 1.1 | registry.redhat.io/rhtas/fulcio-createcerts-rhel9@sha256:2fae433b5864d63470156d36a07cdda08dde72a3894b2d7912d9ae98dda916c7_amd64 |
| Red Hat | registry.redhat.io/rhtas/trillian-createdb-rhel9@sha256:62c33fbce877199e5352268f9f9229be5051791c639eb2daff823ba3d644ddd1_amd64 as a component of Red Hat Trusted Artifact Signer 1.1 | * |
Timeline
- Feb 11, 2025 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 30, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:1327 advisory
- https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.1 advisory
- https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.1/html-single/release_notes/index advisory
- https://access.redhat.com/security/cve/CVE-2024-45337 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1327.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2331720 issue
- https://www.cve.org/CVERecord?id=CVE-2024-45337 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45337 advisory
- https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909 advisory
- https://go.dev/cl/635315 advisory
- https://go.dev/issue/70779 advisory
- https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ advisory
- https://pkg.go.dev/vuln/GO-2024-3321 advisory