Skip to content
Fencer Vulns
critical 9.1

CVE-2024-45337 json

Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto

published 2024-12-11 22 mo ago modified 2026-09-10 1 mo ago also EUVD-2024-3508 , GHSA-v778-237x-gjrc , GO-2024-3321

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
3.2%
EPSS 3.2% chance of exploitation in 30 days, percentile 88%
public exploits
0
none known

Summary

Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Patch / fix

  • go golang.org/x/crypto 0.31.0
  • golang.org/x/crypto golang.org/x/crypto/ssh 0.31.0
  • golang-go.crypto Debian 14 1:0.42.0-1

debian advisories DEBIAN-CVE-2024-45337

  • google-guest-agent Ubuntu 22.04 LTS 20250116.00-0ubuntu1~22.04.1
  • google-guest-agent Ubuntu 24.04 LTS 20250116.00-0ubuntu1~24.04.2
  • golang-go.crypto Ubuntu Pro 16.04 LTS 1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm1
  • golang-go.crypto Ubuntu Pro 18.04 LTS 1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm1
  • golang-go.crypto Ubuntu Pro 20.04 LTS 1:0.0~git20200221.2aa609c-1ubuntu0.1~esm1
  • golang-go.crypto Ubuntu Pro 22.04 LTS 1:0.0~git20211202.5770296-1ubuntu0.1~esm1
  • golang-go.crypto Ubuntu Pro 24.04 LTS 1:0.19.0-1ubuntu0.1~esm1
  • google-guest-agent Ubuntu Pro 16.04 LTS 20240716.00-0ubuntu1~16.04.0+esm1

ubuntu advisories UBUNTU-CVE-2024-45337

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rosa openshift service on aws 1 1.2.53-5be4e19.el8
  • rosa-redistributable openshift service on aws 1 1.2.53-5be4e19.el8

red hat advisories RHEA-2025:4438

  • google-guest-agent SLE Module for Public Cloud 15 SP7, SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5 +2 more 20260529.00-150000.1.70.1
  • google-guest-agent SLE Module for Public Cloud 12 20260529.00-1.61.1
  • vexctl openSUSE Leap 15.6 0.4.1+git78.f951e3a-150000.1.11.1
  • kubevirt SLE Module for Containers 15 SP6, openSUSE Leap 15.6 1.4.1-150600.5.24.1
  • kubevirt SLE Module for Containers 15 SP7 1.5.2-150700.3.5.2
  • release-notes-susemanager Manager Server 4.3 4.3.15.2-150400.3.133.1
  • helm Linux Micro 6.0 3.17.2-1.1
  • helm Linux Micro 6.1 3.17.2-slfo.1.1_1.1

suse advisories SUSE-SU-2026:2612-1SUSE-SU-2026:2581-1SUSE-SU-2026:0592-1SUSE-SU-2025:03278-1SUSE-SU-2025:02581-1SUSE-SU-2025:01985-1

  • k3sup openSUSE Tumbleweed 0.13.14-1.1
  • kubeseal openSUSE Tumbleweed 0.41.1-1.1
  • kumactl openSUSE Tumbleweed 3.0.0-1.1
  • gitea-tea openSUSE Leap 16.0 0.15.1-bp160.1.1
  • vexctl openSUSE Leap 16.0 0.4.4+git20.5d61136-160000.1.1
  • google-guest-agent openSUSE Leap 16.0 20250506.01-160000.1.1
  • vexctl openSUSE Tumbleweed 0.4.1+git78.f951e3a-1.1
  • git-bug openSUSE Leap 16.0 0.10.1-bp160.1.1

opensuse advisories openSUSE-SU-2026:12295-1openSUSE-SU-2026:12299-1openSUSE-SU-2026:12300-1openSUSE-SU-2026:21603-1openSUSE-SU-2026:21481-1openSUSE-SU-2026:20609-1

  • rclone Alpine 3.24, Alpine 3.23, Alpine 3.22 1.69.0-r0

alpine advisories ALPINE-CVE-2024-45337

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • telegraf CBL-Mariner 2.0 1.29.4-10
  • moby-compose CBL-Mariner 2.0 2.17.3-9
  • packer CBL-Mariner 2.0 1.9.5-5
  • cert-manager CBL-Mariner 2.0 1.11.2-16
  • moby-engine CBL-Mariner 2.0 24.0.9-13
  • cf-cli Azure Linux 3.0 8.7.3-4
  • packer Azure Linux 3.0 1.9.5-4
  • kubevirt Azure Linux 3.0 1.2.0-11

azure linux advisories AZL-54281AZL-54286AZL-54290AZL-54317AZL-54320AZL-54327

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-45337 updated cvss 8.2

golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto

  • Red Hat Builds for Red Hat OpenShift openshift-builds-waiters-rhel9, openshift-builds-webhook-rhel9, openshift-builds-controller-rhel9, openshift-builds-git-cloner-rhel9, openshift-builds-image-bundler-rhel9, openshift-builds-image-processing-rhel9, +6 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Multicluster Engine for Kubernetes multicluster-engine/cluster-api-provider-azure-rhel9
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Developer Tools and Services odo, ocp-tools-4/jenkins-rhel8, ocp-tools-4/jenkins-agent-base-rhel8
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Serverless openshift-serverless-1/kn-client-kn-rhel9, openshift-serverless-1/kn-client-cli-artifacts-rhel9, openshift-serverless-1/openshift-serverless-1-func-utils-rhel8 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/gatekeeper-rhel8, multicluster-globalhub-agent-container, multicluster-globalhub-grafana-container, multicluster-globalhub-manager-container, multicluster-globalhub-operator-container, multicluster-globalhub-postgres-exporter-container, +1 more Red Hat Ceph Storage 7 rhceph/grafana-rhel9
    affected: no fix available
  • Red Hat OpenShift AI (RHOAI) odh-data-science-pipelines-argo-argoexec-container, odh-data-science-pipelines-argo-workflowcontroller-container
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-tests, openshift4/ose-console, openshift4/ose-hypershift-rhel8, openshift4/ose-olm-rukpak-rhel8, openshift4/ose-installer-artifacts, openshift4/ose-installer-altinfra-rhel9, +2 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Dev Spaces devspaces/traefik-rhel8 Red Hat Openshift Sandboxed Containers osc-podvm-builder-container, openshift-sandboxed-containers/osc-podvm-payload-rhel9, openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9, openshift-sandboxed-containers/osc-cloud-api-adaptor-webhook-rhel9 Red Hat OpenShift Virtualization 4 kubevirt, container-native-virtualization/virt-api, container-native-virtualization/virt-handler, container-native-virtualization/virt-launcher, container-native-virtualization/virt-operator, container-native-virtualization/virt-controller, +3 more Red Hat OpenStack Platform 16.2 golang-golangorg-crypto-devel
    affected: no fix available
  • Red Hat Storage 3 heketi, heketi-client, python-heketi
    affected: no fix planned “Out of support scope”
show 24 more
  • Red Hat Trusted Artifact Signer trillian-createtree-rhel9
    affected: no fix available
  • Red Hat cert-manager operator for Red Hat OpenShift 1.15 cert-manager
    fixed: vendor fix RHSA-2025:0535
  • Red Hat CNV 4.14 for RHEL 9 container-native-virtualization/virt-api-rhel9 v4.14.14-21, container-native-virtualization/pr-helper-rhel9 v4.14.14-21, container-native-virtualization/virtio-win-rhel9 v4.14.14-9, container-native-virtualization/kubemacpool-rhel9 v4.14.14-11, container-native-virtualization/mtq-operator-rhel9 v4.14.14-11, container-native-virtualization/virt-handler-rhel9 v4.14.14-21, +38 more
    fixed: vendor fix RHEA-2025:15037
  • Red Hat CNV 4.16 for RHEL 9 container-native-virtualization/virt-api-rhel9 v4.16.14-2, container-native-virtualization/pr-helper-rhel9 v4.16.14-2, container-native-virtualization/aaq-server-rhel9 v4.16.14-3, container-native-virtualization/virtio-win-rhel9 v4.16.14-2, container-native-virtualization/wasp-agent-rhel9 v4.16.14-2, container-native-virtualization/kubemacpool-rhel9 v4.16.14-3, +48 more
    fixed: vendor fix RHEA-2025:10586
  • Red Hat CNV 4.17 for RHEL 9 container-native-virtualization/virt-api-rhel9 v4.17.22-3, container-native-virtualization/pr-helper-rhel9 v4.17.22-3, container-native-virtualization/aaq-server-rhel9 v4.17.22-1, container-native-virtualization/virtio-win-rhel9 v4.17.22-1, container-native-virtualization/wasp-agent-rhel9 v4.17.22-1, container-native-virtualization/kubemacpool-rhel9 v4.17.22-1, +46 more
    fixed: vendor fix RHEA-2025:12284
  • Red Hat CNV 4.18 for RHEL 9 container-native-virtualization/virt-api-rhel9 v4.18.1-3, container-native-virtualization/pr-helper-rhel9 v4.18.1-4, container-native-virtualization/virt-api-rhel9 v4.18.12-4, container-native-virtualization/aaq-server-rhel9 v4.18.1-2, container-native-virtualization/pr-helper-rhel9 v4.18.12-4, container-native-virtualization/virtio-win-rhel9 v4.18.1-2, +101 more
    fixed: vendor fix RHEA-2025:3152
  • Red Hat gatekeeper 3.14 for RHEL 9 gatekeeper/gatekeeper-rhel9 v3.14.2-8, gatekeeper/gatekeeper-rhel9-operator v3.14.3-2, gatekeeper/gatekeeper-operator-bundle v3.14.3-3
    fixed: vendor fix RHSA-2025:1333
  • Red Hat gatekeeper 3.15 for RHEL 9 gatekeeper/gatekeeper-rhel9 v3.15.1-26, gatekeeper/gatekeeper-rhel9-operator v3.15.3-1, gatekeeper/gatekeeper-operator-bundle v3.15.3-2
    fixed: vendor fix RHSA-2025:1332
  • Red Hat gatekeeper 3.17 for RHEL 9 gatekeeper/gatekeeper-rhel9 v3.17.1-7, gatekeeper/gatekeeper-rhel9-operator v3.17.1-5, gatekeeper/gatekeeper-operator-bundle v3.17.1-6
    fixed: vendor fix RHSA-2025:1331
  • Red Hat multicluster engine for Kubernetes 2.4 for RHEL 8 multicluster-engine/hive-rhel8 v2.4.7-6, multicluster-engine/work-rhel8 v2.4.7-6, multicluster-engine/discovery-rhel8 v2.4.7-7, multicluster-engine/placement-rhel8 v2.4.7-6, multicluster-engine/cluster-api-rhel8 v2.4.7-5, multicluster-engine/console-mce-rhel8 v2.4.7-7, +31 more
    fixed: vendor fix RHSA-2025:0552
  • Red Hat multicluster engine for Kubernetes 2.5 for RHEL 8 multicluster-engine/hive-rhel8 v2.5.8-10, multicluster-engine/agent-service-rhel8 v2.5.8-24, multicluster-engine/assisted-installer-rhel8 v2.5.8-11, multicluster-engine/assisted-image-service-rhel8 v2.5.8-8, multicluster-engine/assisted-installer-agent-rhel8 v2.5.8-10, multicluster-engine/assisted-installer-reporter-rhel8 v2.5.8-12 Red Hat multicluster engine for Kubernetes 2.5 for RHEL 9 multicluster-engine/work-rhel9 v2.5.8-20, multicluster-engine/discovery-rhel9 v2.5.8-24, multicluster-engine/placement-rhel9 v2.5.8-20, multicluster-engine/cluster-api-rhel9 v2.5.8-8, multicluster-engine/console-mce-rhel9 v2.5.8-24, multicluster-engine/must-gather-rhel9 v2.5.8-26, +26 more
    fixed: vendor fix RHSA-2025:0676
  • Red Hat multicluster engine for Kubernetes 2.6 for RHEL 8 multicluster-engine/assisted-installer-rhel8 v2.6.5-2, multicluster-engine/assisted-service-8-rhel8 v2.6.5-2, multicluster-engine/assisted-image-service-rhel8 v2.6.5-2, multicluster-engine/assisted-installer-agent-rhel8 v2.6.5-2, multicluster-engine/assisted-installer-controller-rhel8 v2.6.5-2 Red Hat multicluster engine for Kubernetes 2.6 for RHEL 9 multicluster-engine/hive-rhel9 v2.6.5-2, multicluster-engine/work-rhel9 v2.6.5-3, multicluster-engine/discovery-rhel9 v2.6.5-3, multicluster-engine/placement-rhel9 v2.6.5-3, multicluster-engine/cluster-api-rhel9 v2.6.5-1, multicluster-engine/console-mce-rhel9 v2.6.5-4, +24 more
    fixed: vendor fix RHSA-2025:0778
  • Red Hat multicluster engine for Kubernetes 2.7 for RHEL 8 multicluster-engine/assisted-service-8-rhel8 v2.7.3-7 Red Hat multicluster engine for Kubernetes 2.7 for RHEL 9 multicluster-engine/hive-rhel9 v2.7.3-4, multicluster-engine/work-rhel9 v2.7.3-7, multicluster-engine/discovery-rhel9 v2.7.3-7, multicluster-engine/placement-rhel9 v2.7.3-7, multicluster-engine/cluster-api-rhel9 v2.7.3-4, multicluster-engine/console-mce-rhel9 v2.7.3-9, +28 more
    fixed: vendor fix RHSA-2025:0723
  • Red Hat multicluster-globalhub 1.2 for RHEL 9 multicluster-globalhub/multicluster-globalhub-agent-rhel9 v1.2.1-3, multicluster-globalhub/multicluster-globalhub-grafana-rhel9 v1.2.1-4, multicluster-globalhub/multicluster-globalhub-manager-rhel9 v1.2.1-3, multicluster-globalhub/multicluster-globalhub-rhel9-operator v1.2.1-3, multicluster-globalhub/multicluster-globalhub-operator-bundle v1.2.1-4, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 v1.2.1-4
    fixed: vendor fix RHSA-2025:0560
  • Red Hat multicluster-globalhub 1.3 for RHEL 9 multicluster-globalhub/multicluster-globalhub-agent-rhel9 v1.3.2-4, multicluster-globalhub/multicluster-globalhub-grafana-rhel9 v1.3.2-4, multicluster-globalhub/multicluster-globalhub-manager-rhel9 v1.3.2-4, multicluster-globalhub/multicluster-globalhub-rhel9-operator v1.3.2-4, multicluster-globalhub/multicluster-globalhub-operator-bundle v1.3.2-6, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 v1.3.2-3, +1 more
    fixed: vendor fix RHSA-2025:0577
  • Red Hat OpenShift API for Data Protection 1.4 oadp/oadp-velero-rhel9 1.4.5-20, oadp/oadp-mustgather-rhel9 1.4.5-34
    fixed: vendor fix RHSA-2025:11396
  • Red Hat Quay v3 quay/quay-rhel8 v3.10.8-6, quay/quay-rhel8 v3.11.8-4, quay/quay-rhel8 v3.12.7-5, quay/quay-rhel8 v3.13.3-6, quay/quay-rhel8 v3.9.10-7, quay/clair-rhel8 v3.10.8-1, +44 more
    fixed: vendor fix RHBA-2025:0250
  • Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8 rhacm2/thanos-rhel8 v2.9.6-6, rhacm2/console-rhel8 v2.9.6-7, rhacm2/memcached-rhel8 v2.9.6-4, rhacm2/prometheus-rhel8 v2.9.6-6, rhacm2/acm-grafana-rhel8 v2.9.6-5, rhacm2/acm-search-v2-rhel8 v2.9.6-5, +38 more
    fixed: vendor fix RHSA-2025:0576
  • Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 rhacm2/thanos-rhel9 v2.10.7-10, rhacm2/console-rhel9 v2.10.7-24, rhacm2/memcached-rhel9 v2.10.7-6, rhacm2/acm-grafana-rhel9 v2.10.7-9, rhacm2/prometheus-rhel9 v2.10.7-11, rhacm2/acm-operator-bundle v2.10.7-63, +38 more
    fixed: vendor fix RHSA-2025:0679
  • Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 rhacm2/thanos-rhel9 v2.11.5-3, rhacm2/console-rhel9 v2.11.5-3, rhacm2/volsync-rhel9 v0.10.2-2, rhacm2/memcached-rhel9 v2.11.5-1, rhacm2/prometheus-rhel9 v2.11.5-3, rhacm2/acm-grafana-rhel9 v2.11.5-2, +39 more
    fixed: vendor fix RHSA-2025:0785
  • Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 rhacm2/thanos-rhel9 v2.12.2-5, rhacm2/acm-cli-rhel9 v2.12.2-7, rhacm2/console-rhel9 v2.12.2-9, rhacm2/volsync-rhel9 v0.11.1-2, rhacm2/memcached-rhel9 v2.12.2-3, rhacm2/prometheus-rhel9 v2.12.2-6, +42 more
    fixed: vendor fix RHSA-2025:0851
  • Red Hat OpenShift AI 2.17 rhoai v2.17.0-1739102637, rhoai v2.17.0-1739102748
    fixed: vendor fix RHSA-2025:1448
  • Red Hat OpenShift AI 2.18 rhoai v2.18.0-1741002425
    fixed: vendor fix RHSA-2025:2588
  • Red Hat OpenShift Container Platform 4.14 openshift4/ose-ptp-rhel9 v4.14.0-202501281905.p0.gade9d9a.assembly.stream.el9, openshift4/ose-agent-installer-api-server-rhel8 v4.14.0-202502111935.p0.g4ddf184.assembly.stream.el8, openshift4 ose-ibmcloud-cluster-api-controllers-container-v4.14.0-202509151013.p2.g8607d6c.assembly.stream.el8
    fixed: vendor fix RHSA-2025:1451

27 more fixed, 40 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
22 mo ago

Exploit prediction

3.18% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
go golang.org/x/crypto
<0.31.0
0.31.0

Affected products

  • golang.org/x/crypto golang.org/x/crypto/ssh

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.