VDB
RHSA-2025%3A1331
RHSA-2025%3A1331
PUBLISHED
CVSS 8.199999809265137 HIGH
A flaw was found in the x/crypto/ssh go library. Applications and libraries that misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. For example, an attacker may send public keys A and B and authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B, for which the attacker does not control the private key. The misuse of ServerConfig.PublicKeyCallback may cause an authorization bypass.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | gatekeeper/gatekeeper-rhel9@sha256:6ea835cbe489df1d27cb8c4b8207cd92a4aeb297b8a46f41f145befc075c9dbc_ppc64le as a component of gatekeeper 3.17 for RHEL 9 | gatekeeper/gatekeeper-rhel9@sha256:6ea835cbe489df1d27cb8c4b8207cd92a4aeb297b8a46f41f145befc075c9dbc_ppc64le |
| Red Hat | gatekeeper/gatekeeper-rhel9-operator@sha256:36dd625b758d637b519742fd9851e1e380c016d5b57b19bae1a8c24046f00723_amd64 as a component of gatekeeper 3.17 for RHEL 9 | gatekeeper/gatekeeper-rhel9-operator@sha256:36dd625b758d637b519742fd9851e1e380c016d5b57b19bae1a8c24046f00723_amd64 |
| Red Hat | gatekeeper/gatekeeper-rhel9-operator@sha256:21e45420b6946604f695abcd47aee1c5b6855fdf8460262e2cc3606ac25ae457_ppc64le as a component of gatekeeper 3.17 for RHEL 9 | gatekeeper/gatekeeper-rhel9-operator@sha256:21e45420b6946604f695abcd47aee1c5b6855fdf8460262e2cc3606ac25ae457_ppc64le |
| Red Hat | gatekeeper/gatekeeper-rhel9@sha256:6a17de79ce8c47d5d269c344f7c7dd9e6be8e9e5aa7559485e4971f56eebb3f6_amd64 as a component of gatekeeper 3.17 for RHEL 9 | *, gatekeeper/gatekeeper-rhel9@sha256:6a17de79ce8c47d5d269c344f7c7dd9e6be8e9e5aa7559485e4971f56eebb3f6_amd64, * |
| Red Hat | gatekeeper/gatekeeper-rhel9@sha256:97bcf5973bee75597281fde6c41617bf19a4a5bf0381f1bb00ba26b5352691c3_s390x as a component of gatekeeper 3.17 for RHEL 9 | gatekeeper/gatekeeper-rhel9@sha256:97bcf5973bee75597281fde6c41617bf19a4a5bf0381f1bb00ba26b5352691c3_s390x |
| Red Hat | gatekeeper/gatekeeper-rhel9@sha256:c33114d526fd24d8e56a863015e71bd6584065902bbc0c13db569d030d15a8f7_arm64 as a component of gatekeeper 3.17 for RHEL 9 | gatekeeper/gatekeeper-rhel9@sha256:c33114d526fd24d8e56a863015e71bd6584065902bbc0c13db569d030d15a8f7_arm64 |
| Red Hat | gatekeeper/gatekeeper-rhel9-operator@sha256:558911a73f9611e756a88c909b2aeab31f5786b29aa7a94d85a0122b50ade941_arm64 as a component of gatekeeper 3.17 for RHEL 9 | *, gatekeeper/gatekeeper-rhel9-operator@sha256:558911a73f9611e756a88c909b2aeab31f5786b29aa7a94d85a0122b50ade941_arm64, * |
| Red Hat | gatekeeper/gatekeeper-rhel9-operator@sha256:52139ff74fc3606384482480745ca760a6be08b744df6009585372d4d2298be8_s390x as a component of gatekeeper 3.17 for RHEL 9 | *, *, gatekeeper/gatekeeper-rhel9-operator@sha256:52139ff74fc3606384482480745ca760a6be08b744df6009585372d4d2298be8_s390x |
| Red Hat | gatekeeper/gatekeeper-rhel9@sha256:6ea835cbe489df1d27cb8c4b8207cd92a4aeb297b8a46f41f145befc075c9dbc_ppc64le as a component of gatekeeper 3.17 for RHEL 9 | *, gatekeeper/gatekeeper-rhel9@sha256:6ea835cbe489df1d27cb8c4b8207cd92a4aeb297b8a46f41f145befc075c9dbc_ppc64le, * |
| Red Hat | gatekeeper/gatekeeper-rhel9-operator@sha256:21e45420b6946604f695abcd47aee1c5b6855fdf8460262e2cc3606ac25ae457_ppc64le | |
| Red Hat | gatekeeper/gatekeeper-rhel9-operator@sha256:21e45420b6946604f695abcd47aee1c5b6855fdf8460262e2cc3606ac25ae457_ppc64le as a component of gatekeeper 3.17 for RHEL 9 | gatekeeper/gatekeeper-rhel9-operator@sha256:21e45420b6946604f695abcd47aee1c5b6855fdf8460262e2cc3606ac25ae457_ppc64le, *, * |
| Red Hat | gatekeeper/gatekeeper-rhel9-operator@sha256:36dd625b758d637b519742fd9851e1e380c016d5b57b19bae1a8c24046f00723_amd64 as a component of gatekeeper 3.17 for RHEL 9 | *, *, * |
| Red Hat | gatekeeper/gatekeeper-operator-bundle@sha256:99e72875ce523e94ed910a0ea149792bd4e3eb0bd53f048b42077a80ddc7a6c9_amd64 as a component of gatekeeper 3.17 for RHEL 9 | gatekeeper/gatekeeper-operator-bundle@sha256:99e72875ce523e94ed910a0ea149792bd4e3eb0bd53f048b42077a80ddc7a6c9_amd64 |
| Red Hat | gatekeeper/gatekeeper-rhel9@sha256:97bcf5973bee75597281fde6c41617bf19a4a5bf0381f1bb00ba26b5352691c3_s390x as a component of gatekeeper 3.17 for RHEL 9 | *, *, * |
| Red Hat | gatekeeper/gatekeeper-rhel9-operator@sha256:52139ff74fc3606384482480745ca760a6be08b744df6009585372d4d2298be8_s390x as a component of gatekeeper 3.17 for RHEL 9 | gatekeeper/gatekeeper-rhel9-operator@sha256:52139ff74fc3606384482480745ca760a6be08b744df6009585372d4d2298be8_s390x |
| Red Hat | gatekeeper/gatekeeper-rhel9@sha256:c33114d526fd24d8e56a863015e71bd6584065902bbc0c13db569d030d15a8f7_arm64 as a component of gatekeeper 3.17 for RHEL 9 | *, gatekeeper/gatekeeper-rhel9@sha256:c33114d526fd24d8e56a863015e71bd6584065902bbc0c13db569d030d15a8f7_arm64, * |
| Red Hat | gatekeeper/gatekeeper-rhel9-operator@sha256:558911a73f9611e756a88c909b2aeab31f5786b29aa7a94d85a0122b50ade941_arm64 as a component of gatekeeper 3.17 for RHEL 9 | gatekeeper/gatekeeper-rhel9-operator@sha256:558911a73f9611e756a88c909b2aeab31f5786b29aa7a94d85a0122b50ade941_arm64 |
| Red Hat | gatekeeper/gatekeeper-rhel9@sha256:6a17de79ce8c47d5d269c344f7c7dd9e6be8e9e5aa7559485e4971f56eebb3f6_amd64 as a component of gatekeeper 3.17 for RHEL 9 | gatekeeper/gatekeeper-rhel9@sha256:6a17de79ce8c47d5d269c344f7c7dd9e6be8e9e5aa7559485e4971f56eebb3f6_amd64 |
| Red Hat | gatekeeper/gatekeeper-rhel9-operator@sha256:36dd625b758d637b519742fd9851e1e380c016d5b57b19bae1a8c24046f00723_amd64 |
…and 1 more
Timeline
- Feb 12, 2025 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Jul 19, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:1331 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.17.0 advisory
- https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.17.1 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2331720 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2333122 issue
- https://issues.redhat.com/browse/HYPBLD-545 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1331.json advisory
- https://access.redhat.com/security/cve/CVE-2024-45337 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-45337 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45337 advisory
- https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909 advisory
- https://go.dev/cl/635315 advisory
- https://go.dev/issue/70779 advisory
- https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ advisory
- https://pkg.go.dev/vuln/GO-2024-3321 advisory
- https://access.redhat.com/security/cve/CVE-2024-45338 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-45338 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45338 advisory
- https://go.dev/cl/637536 advisory
…and 3 more