VDB
RHSA-2025:0386
RHSA-2025:0386
PUBLISHED
CVSS 8.199999809265137 HIGH
A flaw was found in the x/crypto/ssh go library. Applications and libraries that misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. For example, an attacker may send public keys A and B and authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B, for which the attacker does not control the private key. The misuse of ServerConfig.PublicKeyCallback may cause an authorization bypass.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | rhacm2/volsync-operator-bundle@sha256:1cec6197368b7d5a9712b89786d2b17185081a53ade8a693557da580686007bc_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/volsync-operator-bundle@sha256:1cec6197368b7d5a9712b89786d2b17185081a53ade8a693557da580686007bc_amd64 |
| Red Hat | rhacm2/volsync-rhel9@sha256:86e1cc2f2abbcf13e1a104b1d985c8d7685a6c66fb6f2770bb38da165a597848_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/volsync-rhel9@sha256:86e1cc2f2abbcf13e1a104b1d985c8d7685a6c66fb6f2770bb38da165a597848_s390x |
| Red Hat | rhacm2/volsync-rhel9@sha256:1cb132539aa8a0ecb5bf395db48306adcb0ec66deec5c257f54c223b721a65bc_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/volsync-rhel9@sha256:1cb132539aa8a0ecb5bf395db48306adcb0ec66deec5c257f54c223b721a65bc_arm64 |
| Red Hat | rhacm2/volsync-rhel9@sha256:6a041d90d24a4463ee7bc08148ec8c1e811c1b02d9028d66e54ba8be479ae13b_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | * |
| Red Hat | rhacm2/volsync-rhel9@sha256:1cb132539aa8a0ecb5bf395db48306adcb0ec66deec5c257f54c223b721a65bc_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | *, rhacm2/volsync-rhel9@sha256:1cb132539aa8a0ecb5bf395db48306adcb0ec66deec5c257f54c223b721a65bc_arm64, * |
| Red Hat | rhacm2/volsync-rhel9@sha256:c619a9bde6e0afce2dde87fcbc27148dc9ccf83f522662499e0031315a731ce3_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/volsync-rhel9@sha256:c619a9bde6e0afce2dde87fcbc27148dc9ccf83f522662499e0031315a731ce3_amd64, *, * |
| Red Hat | rhacm2/volsync-rhel9@sha256:86e1cc2f2abbcf13e1a104b1d985c8d7685a6c66fb6f2770bb38da165a597848_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/volsync-rhel9@sha256:86e1cc2f2abbcf13e1a104b1d985c8d7685a6c66fb6f2770bb38da165a597848_s390x, *, * |
| Red Hat | rhacm2/volsync-rhel9@sha256:c619a9bde6e0afce2dde87fcbc27148dc9ccf83f522662499e0031315a731ce3_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | * |
| Red Hat | rhacm2/volsync-rhel9@sha256:6a041d90d24a4463ee7bc08148ec8c1e811c1b02d9028d66e54ba8be479ae13b_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | *, rhacm2/volsync-rhel9@sha256:6a041d90d24a4463ee7bc08148ec8c1e811c1b02d9028d66e54ba8be479ae13b_ppc64le, * |
| Red Hat | rhacm2/volsync-operator-bundle@sha256:1cec6197368b7d5a9712b89786d2b17185081a53ade8a693557da580686007bc_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/volsync-operator-bundle@sha256:1cec6197368b7d5a9712b89786d2b17185081a53ade8a693557da580686007bc_amd64, *, * |
| Red Hat |
Timeline
- Jan 16, 2025 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 15, 2026 Security Advisory
- May 15, 2026 Security Advisory
- Jul 19, 2026 CVE Updated
References
- https://access.redhat.com/security/updates/classification/#important advisory
- https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909 advisory
- https://go.dev/cl/635315 advisory
- https://access.redhat.com/security/cve/CVE-2024-53259 advisory
- https://access.redhat.com/errata/RHSA-2025:0386 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2333122 issue
- https://issues.redhat.com/browse/ACM-16523 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0386.json advisory
- https://access.redhat.com/security/cve/CVE-2024-45337 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-45338 advisory
- https://go.dev/cl/637536 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-53259 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-53259 advisory
- https://github.com/quic-go/quic-go/commit/ca31dd355cbe5fc6c5807992d9d1149c66c96a50 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45337 advisory
- https://pkg.go.dev/vuln/GO-2024-3321 advisory
- https://access.redhat.com/security/cve/CVE-2024-45338 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45338 advisory
- https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ advisory
- https://github.com/quic-go/quic-go/pull/4729 advisory
…and 9 more