VDB
RHSA-2025%3A2903
RHSA-2025%3A2903
PUBLISHED
CVSS 8.199999809265137 HIGH
A flaw was found in the x/crypto/ssh go library. Applications and libraries that misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. For example, an attacker may send public keys A and B and authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B, for which the attacker does not control the private key. The misuse of ServerConfig.PublicKeyCallback may cause an authorization bypass.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:919ef15e4ad9e152a5856153ef3e8059a78dfc59551ef841dc6e33aa31abd65f_arm64 as a component of Red Hat OpenShift Pipelines 1.18.0 | registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:919ef15e4ad9e152a5856153ef3e8059a78dfc59551ef841dc6e33aa31abd65f_arm64 |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:7ed05b8f3817d96dc942af19f85ba1b1efdb1f1ff1145356a5287d85a0ecce20_ppc64le as a component of Red Hat OpenShift Pipelines 1.18.0 | registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:7ed05b8f3817d96dc942af19f85ba1b1efdb1f1ff1145356a5287d85a0ecce20_ppc64le |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:a4bdd6a7c3c3bac78a94ac75fb61b0cfc3b674c53163fe606143bfbaf726dd8f_amd64 as a component of Red Hat OpenShift Pipelines 1.18.0 | *, *, * |
| Red Hat | OpenShift Pipelines | |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:a4bdd6a7c3c3bac78a94ac75fb61b0cfc3b674c53163fe606143bfbaf726dd8f_amd64 as a component of Red Hat OpenShift Pipelines 1.18.0 | * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:d31567dafef0040f10b871eae9f6d4dde5b2c7672d11c6607c93ab81bee4c754_s390x as a component of Red Hat OpenShift Pipelines 1.18.0 | registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:d31567dafef0040f10b871eae9f6d4dde5b2c7672d11c6607c93ab81bee4c754_s390x, *, * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:d31567dafef0040f10b871eae9f6d4dde5b2c7672d11c6607c93ab81bee4c754_s390x as a component of Red Hat OpenShift Pipelines 1.18.0 | registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:d31567dafef0040f10b871eae9f6d4dde5b2c7672d11c6607c93ab81bee4c754_s390x |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:919ef15e4ad9e152a5856153ef3e8059a78dfc59551ef841dc6e33aa31abd65f_arm64 as a component of Red Hat OpenShift Pipelines 1.18.0 | *, *, * |
| Red Hat | registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:7ed05b8f3817d96dc942af19f85ba1b1efdb1f1ff1145356a5287d85a0ecce20_ppc64le as a component of Red Hat OpenShift Pipelines 1.18.0 | registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel9@sha256:7ed05b8f3817d96dc942af19f85ba1b1efdb1f1ff1145356a5287d85a0ecce20_ppc64le, *, * |
Timeline
- Mar 17, 2025 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Jul 13, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:2903 advisory
- https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines advisory
- https://access.redhat.com/security/cve/CVE-2024-45337 advisory
- https://access.redhat.com/security/cve/CVE-2024-45338 advisory
- https://access.redhat.com/security/updates/classification advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2903.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2331720 issue
- https://www.cve.org/CVERecord?id=CVE-2024-45337 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45337 advisory
- https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909 advisory
- https://go.dev/cl/635315 advisory
- https://go.dev/issue/70779 advisory
- https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ advisory
- https://pkg.go.dev/vuln/GO-2024-3321 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2333122 issue
- https://www.cve.org/CVERecord?id=CVE-2024-45338 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45338 advisory
- https://go.dev/cl/637536 advisory
- https://go.dev/issue/70906 advisory
- https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ advisory
…and 1 more