VDB
RHSA-2025%3A1849
RHSA-2025%3A1849
PUBLISHED
CVSS 8.199999809265137 HIGH
A flaw was found in the x/crypto/ssh go library. Applications and libraries that misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. For example, an attacker may send public keys A and B and authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B, for which the attacker does not control the private key. The misuse of ServerConfig.PublicKeyCallback may cause an authorization bypass.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhtas/trillian-createdb-rhel9@sha256:2af38a2b19950b8c97d3e05b37f9dd10fa52cc5513379da2e0abc11b9e41eecd_amd64 as a component of Red Hat Trusted Artifact Signer 1.1 | registry.redhat.io/rhtas/trillian-createdb-rhel9@sha256:2af38a2b19950b8c97d3e05b37f9dd10fa52cc5513379da2e0abc11b9e41eecd_amd64 |
| Red Hat | registry.redhat.io/rhtas/fulcio-createcerts-rhel9@sha256:ecc2df433b70ebb55942b3787293a87b280f7c734149547c7a9db85d0f1cc698_amd64 as a component of Red Hat Trusted Artifact Signer 1.1 | registry.redhat.io/rhtas/fulcio-createcerts-rhel9@sha256:ecc2df433b70ebb55942b3787293a87b280f7c734149547c7a9db85d0f1cc698_amd64 |
| Red Hat | registry.redhat.io/rhtas/ctlog-managectroots-rhel9@sha256:eab52da98a670f44bb74bd5612eaf274f1699a9c9ab64bd5dd96f8c340188b0c_amd64 as a component of Red Hat Trusted Artifact Signer 1.1 | registry.redhat.io/rhtas/ctlog-managectroots-rhel9@sha256:eab52da98a670f44bb74bd5612eaf274f1699a9c9ab64bd5dd96f8c340188b0c_amd64 |
| Red Hat | registry.redhat.io/rhtas/tuf-server-rhel9@sha256:16d4ccca29c5b0adae1627f9bbda217a9a0462a4fad32c1b48cce91d400272d3_amd64 as a component of Red Hat Trusted Artifact Signer 1.1 | registry.redhat.io/rhtas/tuf-server-rhel9@sha256:16d4ccca29c5b0adae1627f9bbda217a9a0462a4fad32c1b48cce91d400272d3_amd64 |
| Red Hat | registry.redhat.io/rhtas/trillian-createdb-rhel9@sha256:2af38a2b19950b8c97d3e05b37f9dd10fa52cc5513379da2e0abc11b9e41eecd_amd64 as a component of Red Hat Trusted Artifact Signer 1.1 | registry.redhat.io/rhtas/trillian-createdb-rhel9@sha256:2af38a2b19950b8c97d3e05b37f9dd10fa52cc5513379da2e0abc11b9e41eecd_amd64 |
| Red Hat | registry.redhat.io/rhtas/fulcio-createcerts-rhel9@sha256:ecc2df433b70ebb55942b3787293a87b280f7c734149547c7a9db85d0f1cc698_amd64 as a component of Red Hat Trusted Artifact Signer 1.1 | registry.redhat.io/rhtas/fulcio-createcerts-rhel9@sha256:ecc2df433b70ebb55942b3787293a87b280f7c734149547c7a9db85d0f1cc698_amd64 |
| Red Hat | registry.redhat.io/rhtas/ctlog-managectroots-rhel9@sha256:eab52da98a670f44bb74bd5612eaf274f1699a9c9ab64bd5dd96f8c340188b0c_amd64 as a component of Red Hat Trusted Artifact Signer 1.1 | * |
| Red Hat | registry.redhat.io/rhtas/createctconfig-rhel9@sha256:2615696d76ff38653d5b05f6fd6fc4dad9e2269cbfcc6ea8a8e1e7b887f2e98b_amd64 as a component of Red Hat Trusted Artifact Signer 1.1 | registry.redhat.io/rhtas/createctconfig-rhel9@sha256:2615696d76ff38653d5b05f6fd6fc4dad9e2269cbfcc6ea8a8e1e7b887f2e98b_amd64 |
| Red Hat | registry.redhat.io/rhtas/tuf-server-rhel9@sha256:16d4ccca29c5b0adae1627f9bbda217a9a0462a4fad32c1b48cce91d400272d3_amd64 as a component of Red Hat Trusted Artifact Signer 1.1 | * |
| Red Hat | registry.redhat.io/rhtas/createctconfig-rhel9@sha256:2615696d76ff38653d5b05f6fd6fc4dad9e2269cbfcc6ea8a8e1e7b887f2e98b_amd64 as a component of Red Hat Trusted Artifact Signer 1.1 | registry.redhat.io/rhtas/createctconfig-rhel9@sha256:2615696d76ff38653d5b05f6fd6fc4dad9e2269cbfcc6ea8a8e1e7b887f2e98b_amd64 |
Timeline
- Feb 25, 2025 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 30, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:1849 advisory
- https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.1 advisory
- https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.1/html-single/release_notes/index advisory
- https://access.redhat.com/security/cve/CVE-2024-45337 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1849.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2331720 issue
- https://www.cve.org/CVERecord?id=CVE-2024-45337 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45337 advisory
- https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909 advisory
- https://go.dev/cl/635315 advisory
- https://go.dev/issue/70779 advisory
- https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ advisory
- https://pkg.go.dev/vuln/GO-2024-3321 advisory