VDB
RHSA-2025%3A17690
RHSA-2025%3A17690
PUBLISHED
CVSS 8.199999809265137 HIGH
A flaw was found in the x/crypto/ssh go library. Applications and libraries that misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. For example, an attacker may send public keys A and B and authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B, for which the attacker does not control the private key. The misuse of ServerConfig.PublicKeyCallback may cause an authorization bypass.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-csi-driver-nfs-rhel9@sha256:f920f246b799ed93354825291f56e3b493f62ff929fbc0c12f169e08a14b8947_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-csi-driver-nfs-rhel9@sha256:f920f246b799ed93354825291f56e3b493f62ff929fbc0c12f169e08a14b8947_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-alibaba-cloud-controller-manager-rhel9@sha256:7e5bb9627464c7e4f2595a6c774bb878ad8b11c1c110718a09336b5f5bf090be_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-alibaba-cloud-controller-manager-rhel9@sha256:7e5bb9627464c7e4f2595a6c774bb878ad8b11c1c110718a09336b5f5bf090be_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-thanos-rhel9@sha256:f4f56bfd18ec414e96f0d6789a3e0b4c16e5c846042a29f9090eeedbbe1effd4_s390x as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-thanos-rhel9@sha256:f4f56bfd18ec414e96f0d6789a3e0b4c16e5c846042a29f9090eeedbbe1effd4_s390x |
| Red Hat | registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel9@sha256:8375a167239dfd959e8d69295d4324624df43da54a14339aabd9c687e75e35ad_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel9@sha256:8375a167239dfd959e8d69295d4324624df43da54a14339aabd9c687e75e35ad_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-monitoring-rhel9-operator@sha256:fe5ea9f65214da3006f5da62c3f6770d09c0e9cf3a4ba712cf41b0a89e2b9c86_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-cluster-monitoring-rhel9-operator@sha256:fe5ea9f65214da3006f5da62c3f6770d09c0e9cf3a4ba712cf41b0a89e2b9c86_amd64 |
| Red Hat | registry.redhat.io/openshift4/kube-metrics-server-rhel9@sha256:44b9bccd9d144526964dbe2ddfc3d4da09283546b5b796037163f83189173963_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/kube-metrics-server-rhel9@sha256:44b9bccd9d144526964dbe2ddfc3d4da09283546b5b796037163f83189173963_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-pod-rhel9@sha256:cc3f00767676df10fa99ddbf62ecce7e34d37e1a43376a413e9a515182ec18ba_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-pod-rhel9@sha256:cc3f00767676df10fa99ddbf62ecce7e34d37e1a43376a413e9a515182ec18ba_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-baremetal-machine-controllers-rhel9@sha256:3547b71714112c08240351de8b53c1d88e2e66282c5c8095f0e61be4d9aa9a11_s390x as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-baremetal-machine-controllers-rhel9@sha256:3547b71714112c08240351de8b53c1d88e2e66282c5c8095f0e61be4d9aa9a11_s390x |
| Red Hat | registry.redhat.io/openshift4/ose-console-rhel9-operator@sha256:39dad470527643e6b5ed78ba0ad880310db228be2e575541970d63b4ff641f7e_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-console-rhel9-operator@sha256:39dad470527643e6b5ed78ba0ad880310db228be2e575541970d63b4ff641f7e_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-multus-cni-rhel9@sha256:f17135b3c37f93cadbb2b6dc431230635a91c4a43e122e3e01510b29cbf88ba9_s390x as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-multus-cni-rhel9@sha256:f17135b3c37f93cadbb2b6dc431230635a91c4a43e122e3e01510b29cbf88ba9_s390x |
| Red Hat | registry.redhat.io/openshift4/ose-service-ca-rhel9-operator@sha256:caa95079698179fe54b496596ed7704cdaadd66339e20bb99b6202c90503eba6_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-service-ca-rhel9-operator@sha256:caa95079698179fe54b496596ed7704cdaadd66339e20bb99b6202c90503eba6_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-ironic-machine-os-downloader-rhel9@sha256:b68ae4284142497749edd3fd264d6fcb0b75f96fb2436db5cbc32adf8210630f_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-ironic-machine-os-downloader-rhel9@sha256:b68ae4284142497749edd3fd264d6fcb0b75f96fb2436db5cbc32adf8210630f_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-networking-console-plugin-rhel9@sha256:d8fa78e6c67bfc1717582318e0710332bb9a4a1811800497d0d37a73b80c30b4_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-networking-console-plugin-rhel9@sha256:d8fa78e6c67bfc1717582318e0710332bb9a4a1811800497d0d37a73b80c30b4_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-multus-admission-controller-rhel9@sha256:e9e52427a9ee3571343e19451e1ec93ee68b5bf2a55ea68ab52f45500930ae98_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-multus-admission-controller-rhel9@sha256:e9e52427a9ee3571343e19451e1ec93ee68b5bf2a55ea68ab52f45500930ae98_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-networking-console-plugin-rhel9@sha256:163bce585e8277c98757e984bafa5b07aae7a9027bec8f3cd5336074713451a4_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-networking-console-plugin-rhel9@sha256:163bce585e8277c98757e984bafa5b07aae7a9027bec8f3cd5336074713451a4_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-hypershift-rhel9@sha256:7edba980e32de96bc4452b54b5ed4dc27f2374384883880fc95304bca701b228_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-hypershift-rhel9@sha256:7edba980e32de96bc4452b54b5ed4dc27f2374384883880fc95304bca701b228_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-cloud-controller-manager-rhel9@sha256:f5646f09bd2700eb85f788cfeeeb409ce7762a0422501b0aecbace831db66a30_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-gcp-cloud-controller-manager-rhel9@sha256:f5646f09bd2700eb85f788cfeeeb409ce7762a0422501b0aecbace831db66a30_arm64 |
| Red Hat | registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:d41a82ddc31d28f657b55135871d9fed3e785c0e0c08e74e8380efc58996a794_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:d41a82ddc31d28f657b55135871d9fed3e785c0e0c08e74e8380efc58996a794_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-agent-installer-orchestrator-rhel9@sha256:2ea6a78a32e9224c1a7404c3f446b85551a65ff60f6c1950f2b906d85842ae8b_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-external-resizer-rhel9@sha256:2394ddb5b27e2a74cd31617515e23b69c1239c3d09a41ad8da81e052bebc2bc1_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
…and 1300 more
Timeline
- Oct 15, 2025 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 30, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:17690 advisory
- https://access.redhat.com/security/cve/CVE-2024-45337 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_17690.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2331720 issue
- https://www.cve.org/CVERecord?id=CVE-2024-45337 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45337 advisory
- https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909 advisory
- https://go.dev/cl/635315 advisory
- https://go.dev/issue/70779 advisory
- https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ advisory
- https://pkg.go.dev/vuln/GO-2024-3321 advisory