{"id":"GO-2024-3321","revision":null,"records":[{"revision":"30110e42ac5b4c1ba62408538ff30564","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-45337","aliases":[],"title":"Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","state":0,"publishedAt":"2024-12-11T18:55:58.506+00:00","modifiedAt":"2025-02-18T20:48:40.404+00:00","affected":[{"ecosystem":"https://pkg.go.dev","name":"golang.org/x/crypto/ssh","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"golang.org/x/crypto\",\n                    \"product\": \"golang.org/x/crypto/ssh\",\n                    \"collectionURL\": \"https://pkg.go.dev\",\n                    \"packageName\": \"golang.org/x/crypto/ssh\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"0.31.0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"ServerConfig.PublicKeyCallback\"\n                        },\n                        {\n                            \"name\": \"connection.serverAuthenticate\"\n                        },\n                        {\n                            \"name\": \"NewServerConn\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909","https://go.dev/cl/635315","https://go.dev/issue/70779","https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ","https://pkg.go.dev/vuln/GO-2024-3321"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-45337","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-45337","identifiers":["CVE-2024-45337"]},"retained":false,"historicalAffected":[]},{"revision":"4afeed08fd6440d6b24aca1b591fa41f","observedAt":"2026-11-15T03:42:12.439+00:00","statement":{"source":"euvd","id":"EUVD-2024-3508","aliases":["CVE-2024-45337","GHSA-v778-237x-gjrc"],"title":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call …","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1,"severity":null}],"references":["https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909","https://go.dev/cl/635315","https://go.dev/issue/70779","https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ","https://pkg.go.dev/vuln/GO-2024-3321"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-3508","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Dec 11, 2024, 6:55:58 PM","dateUpdated":"Feb 18, 2025, 8:48:40 PM"},"relatedAdvisories":[{"id":"SUSE-SU-2026:2581-1","title":"Security update for google-guest-agent","vulnerabilityIds":["CVE-2023-45288","CVE-2024-45337","CVE-2025-22868","CVE-2025-22869","CVE-2025-58181","CVE-2026-33186","CVE-2026-33814","CVE-2026-34986","CVE-2026-39821","CVE-2026-39827","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39833","CVE-2026-39834","CVE-2026-39835","CVE-2026-42508","CVE-2026-46595","CVE-2026-46597","CVE-2026-46598"]},{"id":"RHSA-2025:1448","title":"Red Hat Security Advisory: RHOAI 2.17.0 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2024-21538","CVE-2024-45337","CVE-2024-45338","CVE-2024-45339","CVE-2024-49767","CVE-2024-52798","CVE-2024-55565"]},{"id":"SUSE-SU-2025:1143-1","title":"Security update for google-guest-agent","vulnerabilityIds":["CVE-2024-45337"]},{"id":"openSUSE-SU-2025:14641-1","title":"rclone-1.69.0-1.1 on GA media","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"RHBA-2025:1076","title":"Red Hat Bug Fix Advisory: Red Hat Quay v3.11.8 bug fix release","vulnerabilityIds":["CVE-2024-45337","CVE-2024-56201","CVE-2024-56326"]},{"id":"RHSA-2025:17232","title":"Red Hat Security Advisory: OpenShift Container Platform 4.17.41 bug fix and security update","vulnerabilityIds":["CVE-2024-45337"]},{"id":"RHSA-2024:11037","title":"Red Hat Security Advisory: OpenShift Container Platform 4.19.0 security and extras update","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2025-22868","CVE-2025-22869"]},{"id":"openSUSE-SU-2025:20117-1","title":"Security update for trivy","vulnerabilityIds":["CVE-2024-3817","CVE-2024-45337","CVE-2024-45338","CVE-2024-51744","CVE-2025-11065","CVE-2025-21613","CVE-2025-21614","CVE-2025-22868","CVE-2025-22869","CVE-2025-22872","CVE-2025-27144","CVE-2025-30204","CVE-2025-46569","CVE-2025-47291","CVE-2025-53547","CVE-2025-58058"]},{"id":"RHSA-2025:8244","title":"Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.21.0 release","vulnerabilityIds":["CVE-2024-12905","CVE-2024-45337","CVE-2024-45410","CVE-2025-22869","CVE-2025-30204"]},{"id":"openSUSE-SU-2025:15463-1","title":"docker-machine-driver-kvm2-1.36.0-2.1 on GA media","vulnerabilityIds":["CVE-2024-45337"]},{"id":"openSUSE-SU-2024:14585-1","title":"cloudflared-2024.12.1-1.1 on GA media","vulnerabilityIds":["CVE-2024-45337"]},{"id":"RHBA-2025:0301","title":"Red Hat Bug Fix Advisory: Red Hat Quay v3.13.3 bug fix release","vulnerabilityIds":["CVE-2024-45337","CVE-2024-55565","CVE-2024-56201","CVE-2024-56326"]},{"id":"SUSE-SU-2025:03278-1","title":"Security update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2025-22872"]},{"id":"RHSA-2026:2681","title":"Red Hat Security Advisory: Red Hat Quay 3.16.2","vulnerabilityIds":["CVE-2024-34156","CVE-2024-45337","CVE-2024-45338","CVE-2025-15284","CVE-2025-31133","CVE-2025-52881","CVE-2025-61726","CVE-2025-61729","CVE-2025-65945","CVE-2025-66418","CVE-2025-66471","CVE-2026-21441","CVE-2026-24049"]},{"id":"openSUSE-SU-2024:14604-1","title":"logcli-3.3.2-1.1 on GA media","vulnerabilityIds":["CVE-2024-45337"]},{"id":"openSUSE-SU-2024:14593-1","title":"helm-3.16.4-1.1 on GA media","vulnerabilityIds":["CVE-2024-45337"]},{"id":"RHSA-2025:0778","title":"Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.6.5 security updates and bug fixes","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2024-55565"]},{"id":"RHSA-2025:23203","title":"Red Hat Security Advisory: Red Hat OpenShift GitOps v1.18.2 security update","vulnerabilityIds":["CVE-2024-45337","CVE-2025-13888","CVE-2025-49844"]},{"id":"RHBA-2025:1077","title":"Red Hat Bug Fix Advisory: Red Hat Quay v3.10.8 bug fix release","vulnerabilityIds":["CVE-2024-45337","CVE-2024-56201","CVE-2024-56326"]},{"id":"openSUSE-SU-2024:14599-1","title":"govulncheck-vulndb-0.0.20241213T205935-1.1 on GA media","vulnerabilityIds":["CVE-2020-10696","CVE-2020-8912","CVE-2022-31668","CVE-2023-26248","CVE-2023-3676","CVE-2023-3955","CVE-2024-12401","CVE-2024-37032","CVE-2024-44337","CVE-2024-45039","CVE-2024-45337","CVE-2024-45436","CVE-2024-46455","CVE-2024-46528","CVE-2024-53257","CVE-2024-53859","CVE-2024-55601","CVE-2024-55657","CVE-2024-55658","CVE-2024-55659","CVE-2024-55660"]},{"id":"openSUSE-SU-2025:14920-1","title":"gitleaks-8.24.2-1.1 on GA media","vulnerabilityIds":["CVE-2024-45337"]},{"id":"RHSA-2025:0679","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.10.7 bug fixes and container updates","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"RHEA-2025:12284","title":"Red Hat Enhancement Advisory: OpenShift Virtualization 4.17.22 Images","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2025-22869"]},{"id":"RHSA-2025:15680","title":"Red Hat Security Advisory: OpenShift Container Platform 4.16.48 bug fix and security update","vulnerabilityIds":["CVE-2024-45337"]},{"id":"RHSA-2025:0649","title":"Red Hat Security Advisory: OpenShift Container Platform 4.16.32 security and extras update","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"RHSA-2025:0536","title":"Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.15.0","vulnerabilityIds":["CVE-2023-45288","CVE-2024-6104","CVE-2024-24783","CVE-2024-28180","CVE-2024-35255","CVE-2024-45337","CVE-2024-45338"]},{"id":"RHSA-2025:0485","title":"Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.15.0","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"RHSA-2025:0385","title":"Red Hat Security Advisory: VolSync 0.11.1 for RHEL 9","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2024-53259"]},{"id":"SUSE-SU-2025:0770-1","title":"Security update for govulncheck-vulndb","vulnerabilityIds":["CVE-2024-45337","CVE-2025-22868","CVE-2025-22869"]},{"id":"RHSA-2025:0723","title":"Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.7.3 security updates and bug fixes","vulnerabilityIds":["CVE-2024-45337","CVE-2024-55565"]},{"id":"RHSA-2025:0892","title":"Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.18.0 release","vulnerabilityIds":["CVE-2023-44270","CVE-2024-21538","CVE-2024-45337","CVE-2024-45338","CVE-2024-45801","CVE-2024-53899","CVE-2024-55565"]},{"id":"openSUSE-SU-2025:14660-1","title":"golang-github-prometheus-prometheus-3.1.0-1.1 on GA media","vulnerabilityIds":["CVE-2024-45337"]},{"id":"RHSA-2025:0535","title":"Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.15.0","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"openSUSE-SU-2026:20620-1","title":"Security update for rclone","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2024-51744","CVE-2024-52522","CVE-2025-22869","CVE-2025-22870","CVE-2025-30204","CVE-2025-58181","CVE-2025-68121","CVE-2026-1229","CVE-2026-27141","CVE-2026-33186","CVE-2026-41176","CVE-2026-41179"]},{"id":"openSUSE-SU-2026:12299-1","title":"kubeseal-0.41.1-1.1 on GA media","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2025-47911","CVE-2025-58181"]},{"id":"RHSA-2025:16165","title":"Red Hat Security Advisory: OpenShift Container Platform 4.14.57 bug fix and security update","vulnerabilityIds":["CVE-2024-45337","CVE-2025-22869"]},{"id":"RHSA-2025:1841","title":"Red Hat Security Advisory: RHTAS 1.1.1 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"openSUSE-SU-2025:0025-1","title":"Security update for cheat","vulnerabilityIds":["CVE-2024-45337"]},{"id":"openSUSE-SU-2024:14573-1","title":"teleport-17.0.5-1.1 on GA media","vulnerabilityIds":["CVE-2024-45337"]},{"id":"RHSA-2025:10771","title":"Red Hat Security Advisory: OpenShift Container Platform 4.19.4 bug fix and security update","vulnerabilityIds":["CVE-2024-45337","CVE-2025-32462"]},{"id":"RHSA-2025:0386","title":"Red Hat Security Advisory: VolSync 0.10.2 for RHEL 9","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2024-53259"]},{"id":"RHSA-2025:0653","title":"Red Hat Security Advisory: OpenShift Container Platform 4.17.14 security and extras update","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"openSUSE-SU-2025:15779-1","title":"helm3-3.19.2-1.1 on GA media","vulnerabilityIds":["CVE-2018-16873","CVE-2018-16874","CVE-2018-16875","CVE-2021-21272","CVE-2022-1996","CVE-2022-23524","CVE-2022-23525","CVE-2022-23526","CVE-2022-36055","CVE-2023-25165","CVE-2023-25173","CVE-2024-25620","CVE-2024-26147","CVE-2024-45337","CVE-2024-45338","CVE-2025-22870","CVE-2025-22872","CVE-2025-47911","CVE-2025-53547","CVE-2025-58190"]},{"id":"RHSA-2025:1332","title":"Red Hat Security Advisory: Gatekeeper v3.15.3","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"RHSA-2025:0445","title":"Red Hat Security Advisory: Red Hat Trusted Profile Analyzer 1.2.2","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2025-21613","CVE-2025-21614"]},{"id":"SUSE-SU-2025:20278-1","title":"Security update for helm","vulnerabilityIds":["CVE-2024-25620","CVE-2024-26147","CVE-2024-45337","CVE-2024-45338","CVE-2025-22870"]},{"id":"openSUSE-SU-2025-20117-1","title":"Security update for trivy","vulnerabilityIds":["CVE-2024-3817","CVE-2024-45337","CVE-2024-45338","CVE-2024-51744","CVE-2025-11065","CVE-2025-21613","CVE-2025-21614","CVE-2025-22868","CVE-2025-22869","CVE-2025-22872","CVE-2025-27144","CVE-2025-30204","CVE-2025-46569","CVE-2025-47291","CVE-2025-53547","CVE-2025-58058"]},{"id":"openSUSE-SU-2024:14595-1","title":"traefik2-2.11.16-1.1 on GA media","vulnerabilityIds":["CVE-2024-45337"]},{"id":"openSUSE-SU-2026:21603-1","title":"Security update for gitea-tea","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2025-22869","CVE-2025-22872","CVE-2025-47911","CVE-2025-47913","CVE-2025-58190"]},{"id":"RHSA-2025:2903","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.18.0","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"SUSE-SU-2025:0524-1","title":"Security update for SUSE Manager Client Tools","vulnerabilityIds":["CVE-2023-3128","CVE-2023-6152","CVE-2024-22037","CVE-2024-45337","CVE-2024-51744","CVE-2024-6837","CVE-2024-8118"]},{"id":"RHSA-2025:1287","title":"Red Hat Security Advisory: RHTAS 1.1.1 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2024-45337"]},{"id":"RHSA-2025:22287","title":"Red Hat Security Advisory: Red Hat Quay 3.9","vulnerabilityIds":["CVE-2024-34156","CVE-2024-45337","CVE-2024-45338","CVE-2025-59420","CVE-2025-61920"]},{"id":"RHSA-2025:19306","title":"Red Hat Security Advisory: OpenShift Container Platform 4.15.59 bug fix and security update","vulnerabilityIds":["CVE-2024-45337","CVE-2024-48910","CVE-2025-22871"]},{"id":"RHSA-2025:0370","title":"Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.4 release","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"RHEA-2025:10586","title":"Red Hat Enhancement Advisory: OpenShift Virtualization 4.16.14 Images","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2025-22869"]},{"id":"RHSA-2025:1849","title":"Red Hat Security Advisory: RHTAS 1.1.1 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2024-45337"]},{"id":"openSUSE-SU-2025:14613-1","title":"velero-1.15.1-1.1 on GA media","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"openSUSE-SU-2025:14969-1","title":"google-guest-agent-20250327.01-1.1 on GA media","vulnerabilityIds":["CVE-2024-45337"]},{"id":"openSUSE-SU-2025:0056-1","title":"Security update for trivy","vulnerabilityIds":["CVE-2024-34155","CVE-2024-34156","CVE-2024-34158","CVE-2024-3817","CVE-2024-45337","CVE-2024-45338","CVE-2025-21613","CVE-2025-21614"]},{"id":"SUSE-SU-2025:20196-1","title":"Security update for helm","vulnerabilityIds":["CVE-2024-25620","CVE-2024-26147","CVE-2024-45337","CVE-2024-45338","CVE-2025-22870"]},{"id":"openSUSE-SU-2025:0094-1","title":"Security update for gitea-tea","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2025-22869"]},{"id":"RHSA-2025:0676","title":"Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.5.8 security updates and bug fixes","vulnerabilityIds":["CVE-2024-45337"]},{"id":"RHSA-2025:1334","title":"Red Hat Security Advisory: ACS 4.5 enhancement and security update","vulnerabilityIds":["CVE-2024-11831","CVE-2024-45337","CVE-2024-45338","CVE-2025-21613","CVE-2025-21614"]},{"id":"openSUSE-SU-2026:12295-1","title":"k3sup-0.13.14-1.1 on GA media","vulnerabilityIds":["CVE-2024-45337","CVE-2025-22869","CVE-2025-47913","CVE-2025-47914","CVE-2025-58181"]},{"id":"RHSA-2026:6568","title":"Red Hat Security Advisory: Red Hat Quay 3.15.4","vulnerabilityIds":["CVE-2024-34156","CVE-2024-45337","CVE-2024-45338","CVE-2025-61726","CVE-2025-61728","CVE-2025-61729","CVE-2025-68121","CVE-2025-68158","CVE-2025-69873","CVE-2026-4598","CVE-2026-4599","CVE-2026-4600","CVE-2026-4601","CVE-2026-4602","CVE-2026-25639","CVE-2026-25990","CVE-2026-26007","CVE-2026-26996","CVE-2026-27628","CVE-2026-27904","CVE-2026-28498","CVE-2026-28802","CVE-2026-29063","CVE-2026-29074","CVE-2026-30922","CVE-2026-32597"]},{"id":"openSUSE-SU-2025:14633-1","title":"grafana-11.3.0-4.1 on GA media","vulnerabilityIds":["CVE-2024-45337"]},{"id":"RHSA-2025:1322","title":"Red Hat Security Advisory: RHTAS 1.1.1 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2024-45337"]},{"id":"RHSA-2025:3820","title":"Red Hat Security Advisory: RHTAS 1.1.2 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2024-45337","CVE-2025-22868","CVE-2025-22869","CVE-2025-27144","CVE-2025-30204"]},{"id":"RHSA-2025:17690","title":"Red Hat Security Advisory: OpenShift Container Platform 4.16.50 bug fix and security update","vulnerabilityIds":["CVE-2024-45337"]},{"id":"SUSE-SU-2026:0592-1","title":"Security update for vexctl","vulnerabilityIds":["CVE-2024-45337","CVE-2025-22868","CVE-2025-22869","CVE-2025-22870","CVE-2025-27144","CVE-2025-30204","CVE-2025-58181","CVE-2026-22772","CVE-2026-24137"]},{"id":"SUSE-SU-2025:0980-1","title":"Security update for apptainer","vulnerabilityIds":["CVE-2024-41110","CVE-2024-45337","CVE-2024-45338","CVE-2025-22869","CVE-2025-22870","CVE-2025-27144"]},{"id":"SUSE-SU-2025:0545-1","title":"Security update for grafana","vulnerabilityIds":["CVE-2023-3128","CVE-2023-6152","CVE-2024-45337","CVE-2024-6837","CVE-2024-8118"]},{"id":"openSUSE-SU-2024:14590-1","title":"traefik-3.2.3-1.1 on GA media","vulnerabilityIds":["CVE-2024-45337"]},{"id":"RHSA-2025:23064","title":"Red Hat Security Advisory: Red Hat Quay 3.10.17","vulnerabilityIds":["CVE-2024-34156","CVE-2024-45337","CVE-2024-45338","CVE-2025-47913","CVE-2025-59420","CVE-2025-61920"]},{"id":"SUSE-SU-2025:0601-1","title":"Security update for brise","vulnerabilityIds":["CVE-2024-45337","CVE-2025-21613"]},{"id":"RHSA-2025:0851","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.12.2 security and bug fix updates","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2024-55565"]},{"id":"RHSA-2025:3069","title":"Red Hat Security Advisory: Errata Advisory for Red Hat OpenShift GitOps v1.14.3 security update","vulnerabilityIds":["CVE-2023-44270","CVE-2024-45337","CVE-2024-45338","CVE-2025-21613","CVE-2025-21614","CVE-2025-23216"]},{"id":"RHSA-2025:0444","title":"Red Hat Security Advisory: Red Hat Trusted Profile Analyzer 1.2.2","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2025-21613","CVE-2025-21614"]},{"id":"RHSA-2025:1331","title":"Red Hat Security Advisory: Gatekeeper v3.17.1","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"RHSA-2025:3542","title":"Red Hat Security Advisory: RHODF-4.15-RHEL-9 security update","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"openSUSE-SU-2024:14602-1","title":"tailscale-1.78.3-2.1 on GA media","vulnerabilityIds":["CVE-2024-45337"]},{"id":"openSUSE-SU-2025:14713-1","title":"trivy-0.58.2-1.1 on GA media","vulnerabilityIds":["CVE-2024-3817","CVE-2024-45337","CVE-2024-45338","CVE-2025-21613"]},{"id":"RHSA-2024:6121","title":"Red Hat Security Advisory: OpenShift Container Platform 4.18.1 security and extras update","vulnerabilityIds":["CVE-2019-25210","CVE-2023-44270","CVE-2024-21538","CVE-2024-45337","CVE-2024-45338","CVE-2024-45590","CVE-2024-48910","CVE-2024-52798","CVE-2024-55565","CVE-2024-56201","CVE-2024-56326","CVE-2025-21613","CVE-2025-21614"]},{"id":"RHSA-2025:1451","title":"Red Hat Security Advisory: OpenShift Container Platform 4.14.48 security update","vulnerabilityIds":["CVE-2024-12085","CVE-2024-45337","CVE-2024-45338","CVE-2024-53104"]},{"id":"RHSA-2025:11396","title":"Red Hat Security Advisory: OpenShift API for Data Protection (OADP) 1.4.5 security and bug fix update","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2025-21613","CVE-2025-22868","CVE-2025-22869","CVE-2025-22871","CVE-2025-27144","CVE-2025-30204"]},{"id":"openSUSE-SU-2026:10230-1","title":"vexctl-0.4.1+git78.f951e3a-1.1 on GA media","vulnerabilityIds":["CVE-2024-45337","CVE-2025-22868","CVE-2025-22869","CVE-2025-22870","CVE-2025-27144","CVE-2025-30204","CVE-2025-58181","CVE-2026-22772","CVE-2026-24137"]},{"id":"RHSA-2025:0552","title":"Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.4.7 security updates and bug fixes","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"RHSA-2025:2588","title":"Red Hat Security Advisory: RHOAI 2.18.0 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2024-11187","CVE-2024-45337","CVE-2024-45338","CVE-2025-22150","CVE-2025-24970"]},{"id":"RHSA-2025:1845","title":"Red Hat Security Advisory: RHTAS 1.1.1 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2024-45337"]},{"id":"RHSA-2025:23206","title":"Red Hat Security Advisory: Red Hat OpenShift GitOps v1.17.3 security update","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2025-13888","CVE-2025-49844"]},{"id":"RHSA-2025:1325","title":"Red Hat Security Advisory: RHTAS 1.1.1 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2024-45337"]},{"id":"openSUSE-SU-2026:12300-1","title":"kumactl-3.0.0-1.1 on GA media","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2024-51744","CVE-2025-22869","CVE-2025-22872","CVE-2025-30204","CVE-2025-47911","CVE-2025-47913","CVE-2025-47914","CVE-2025-58181","CVE-2025-58190","CVE-2026-26958","CVE-2026-33186","CVE-2026-41178"]},{"id":"openSUSE-SU-2026:20730-1","title":"Security update for apptainer","vulnerabilityIds":["CVE-2023-45288","CVE-2024-28180","CVE-2024-3727","CVE-2024-41110","CVE-2024-45337","CVE-2024-45338","CVE-2025-22869","CVE-2025-22870","CVE-2025-22872","CVE-2025-27144","CVE-2025-47911","CVE-2025-47913","CVE-2025-47914","CVE-2025-58181","CVE-2025-58190","CVE-2025-65105","CVE-2025-8556","CVE-2026-24137","CVE-2026-33186","CVE-2026-34986"]},{"id":"SUSE-SU-2025:1142-1","title":"Security update for google-guest-agent","vulnerabilityIds":["CVE-2024-45337"]},{"id":"SUSE-SU-2025:01985-1","title":"Security update 4.3.15 for Multi-Linux Manager Server","vulnerabilityIds":["CVE-2023-45288","CVE-2024-11741","CVE-2024-45337","CVE-2024-45339","CVE-2024-47535","CVE-2024-51744","CVE-2024-9264","CVE-2024-9476","CVE-2025-22870","CVE-2025-22872","CVE-2025-2703","CVE-2025-27144","CVE-2025-3454","CVE-2025-3580","CVE-2025-4123"]},{"id":"RHSA-2025:0577","title":"Red Hat Security Advisory: Red Hat multicluster global hub 1.3.2 enhancements and container updates","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"RHSA-2025:1829","title":"Red Hat Security Advisory: RHODF-4.16-RHEL-9 security update","vulnerabilityIds":["CVE-2023-44270","CVE-2024-6104","CVE-2024-21528","CVE-2024-45337","CVE-2024-45338"]},{"id":"RHSA-2026:2762","title":"Red Hat Security Advisory: Red Hat Quay 3.10.18","vulnerabilityIds":["CVE-2024-34156","CVE-2024-45337","CVE-2024-45338","CVE-2025-12816","CVE-2025-15284","CVE-2025-52881","CVE-2025-61729","CVE-2025-65945","CVE-2025-66031","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2026-21441","CVE-2026-24049"]},{"id":"RHSA-2025:1327","title":"Red Hat Security Advisory: RHTAS 1.1.1 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2024-45337"]},{"id":"RHSA-2025:16160","title":"Red Hat Security Advisory: OpenShift Container Platform 4.15.58 bug fix and security update","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45339","CVE-2025-22869"]},{"id":"RHSA-2025:1289","title":"Red Hat Security Advisory: RHTAS 1.1.1 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"RHSA-2025:0839","title":"Red Hat Security Advisory: OpenShift Container Platform 4.14.46 security update","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"RHSA-2025:1468","title":"Red Hat Security Advisory: ACS 4.4 enhancement and security update","vulnerabilityIds":["CVE-2024-11831","CVE-2024-45337","CVE-2024-45338","CVE-2025-21613","CVE-2025-21614"]},{"id":"RHSA-2025:0560","title":"Red Hat Security Advisory: Red Hat Multicluster GlobalHub 1.2.1 bug fixes and container updates","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"openSUSE-SU-2026:20609-1","title":"Security update for google-guest-agent","vulnerabilityIds":["CVE-2023-45288","CVE-2024-45337"]},{"id":"RHSA-2025:1324","title":"Red Hat Security Advisory: RHTAS 1.1.1 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"RHSA-2025:23207","title":"Red Hat Security Advisory: Red Hat OpenShift GitOps v1.16.5 security update","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2025-13888","CVE-2025-49844"]},{"id":"openSUSE-SU-2025:14902-1","title":"rime-plum-1.0.3-1.1 on GA media","vulnerabilityIds":["CVE-2024-45337","CVE-2025-2161","CVE-2025-21613"]},{"id":"RHSA-2025:1824","title":"Red Hat Security Advisory: RHODF-4.17-RHEL-9 security update","vulnerabilityIds":["CVE-2023-44270","CVE-2024-21528","CVE-2024-45337","CVE-2024-45338","CVE-2025-0426"]},{"id":"RHSA-2025:0645","title":"Red Hat Security Advisory: OpenShift Container Platform 4.15.44 security update","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"RHSA-2025:17657","title":"Red Hat Security Advisory: OpenShift Container Platform 4.18.26 bug fix and security update","vulnerabilityIds":["CVE-2024-45337"]},{"id":"RHBA-2025:1597","title":"Red Hat Bug Fix Advisory: Red Hat Quay v3.9.10 bug fix release","vulnerabilityIds":["CVE-2020-11023","CVE-2024-45337","CVE-2024-56201","CVE-2024-56326"]},{"id":"RHSA-2025:0522","title":"Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Jaeger) 3.4 release","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"openSUSE-SU-2025:20143-1","title":"Security update for git-bug","vulnerabilityIds":["CVE-2024-45337","CVE-2025-22869","CVE-2025-47911","CVE-2025-47913","CVE-2025-47914","CVE-2025-58181","CVE-2025-58190"]},{"id":"RHSA-2025:0576","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.9.6 bug fixes and container updates","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"openSUSE-SU-2026:21481-1","title":"Security update for vexctl","vulnerabilityIds":["CVE-2024-45337","CVE-2025-22868","CVE-2025-22869","CVE-2025-22870","CVE-2025-27144","CVE-2025-30204","CVE-2025-58181","CVE-2026-22772","CVE-2026-24137"]},{"id":"RHSA-2025:1285","title":"Red Hat Security Advisory: RHTAS 1.1.1 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2024-45337"]},{"id":"openSUSE-SU-2025:15013-1","title":"gopass-1.15.16-1.1 on GA media","vulnerabilityIds":["CVE-2024-45337"]},{"id":"openSUSE-SU-2026:20893-1","title":"Security update for cloudflared","vulnerabilityIds":["CVE-2024-45337","CVE-2025-22869","CVE-2025-58181","CVE-2026-33814","CVE-2026-39821"]},{"id":"RHSA-2025:22182","title":"Red Hat Security Advisory: Red Hat Quay 3.10.16","vulnerabilityIds":["CVE-2024-34156","CVE-2024-45337","CVE-2024-45338","CVE-2025-59420","CVE-2025-61920"]},{"id":"RHSA-2025:1333","title":"Red Hat Security Advisory: Gatekeeper v3.14.3","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"msrc_CVE-2024-45337","title":"Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto","vulnerabilityIds":["CVE-2024-45337"]},{"id":"RHSA-2025:3560","title":"Red Hat Security Advisory: RHODF-4.14-RHEL-9 security update","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"RHEA-2025:3152","title":"Red Hat Enhancement Advisory: OpenShift Virtualization 4.18.1 Images","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2025-21613","CVE-2025-21614","CVE-2025-27144"]},{"id":"SUSE-SU-2026:21319-1","title":"Security update for google-guest-agent","vulnerabilityIds":["CVE-2023-45288","CVE-2024-45337"]},{"id":"SUSE-SU-2025:0602-1","title":"Security update for helm","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"RHBA-2025:0250","title":"Red Hat Bug Fix Advisory: Red Hat Quay v3.12.7 bug fix release","vulnerabilityIds":["CVE-2024-45337","CVE-2024-56201","CVE-2024-56326"]},{"id":"RHSA-2025:0785","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.11.5 bug fixes and container updates","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2024-55565"]},{"id":"RHSA-2026:1730","title":"Red Hat Security Advisory: Red Hat Quay 3.12.13","vulnerabilityIds":["CVE-2024-34156","CVE-2024-45337","CVE-2024-45338","CVE-2025-12816","CVE-2025-15284","CVE-2025-52881","CVE-2025-65945","CVE-2025-66031","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2026-21441"]},{"id":"openSUSE-SU-2026:20798-1","title":"Security update for trivy","vulnerabilityIds":["CVE-2024-3817","CVE-2024-45337","CVE-2024-45338","CVE-2024-51744","CVE-2025-11065","CVE-2025-21613","CVE-2025-21614","CVE-2025-22868","CVE-2025-22869","CVE-2025-22872","CVE-2025-27144","CVE-2025-30204","CVE-2025-46569","CVE-2025-47291","CVE-2025-47911","CVE-2025-47913","CVE-2025-47914","CVE-2025-53547","CVE-2025-58058","CVE-2025-58181","CVE-2025-58190"]},{"id":"RHSA-2025:2652","title":"Red Hat Security Advisory: RHODF-4.18-RHEL-9 enhancement, bug fix and security update","vulnerabilityIds":["CVE-2023-44270","CVE-2024-21528","CVE-2024-21538","CVE-2024-45337","CVE-2024-45338","CVE-2024-55565","CVE-2025-0426"]},{"id":"openSUSE-SU-2024:14592-1","title":"git-bug-0.8.0+git.1733745604.d499b6e-1.1 on GA media","vulnerabilityIds":["CVE-2024-45337"]},{"id":"RHSA-2025:0390","title":"Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.4 release","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"RHSA-2026:2754","title":"Red Hat Security Advisory: Red Hat Quay 3.9.18","vulnerabilityIds":["CVE-2024-34156","CVE-2024-45337","CVE-2024-45338","CVE-2025-12816","CVE-2025-52881","CVE-2025-61726","CVE-2025-61729","CVE-2025-65945","CVE-2025-66031","CVE-2025-66418","CVE-2025-66506","CVE-2026-24049"]},{"id":"RHSA-2025:23061","title":"Red Hat Security Advisory: Red Hat Quay 3.9.17","vulnerabilityIds":["CVE-2024-34156","CVE-2024-45337","CVE-2024-45338","CVE-2025-47913","CVE-2025-59420","CVE-2025-61920"]},{"id":"RHSA-2025:1847","title":"Red Hat Security Advisory: RHTAS 1.1.1 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2024-45337"]},{"id":"WID-SEC-W-2025-0226","title":"Red Hat Enterprise Linux (Advanced Cluster Management): Mehrere Schwachstellen","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2024-55565"]},{"id":"RHSA-2025:1848","title":"Red Hat Security Advisory: RHTAS 1.1.1 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2024-45337"]},{"id":"WID-SEC-W-2024-3690","title":"Gitea: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen","vulnerabilityIds":["CVE-2024-45337"]},{"id":"openSUSE-SU-2025:14909-1","title":"apptainer-1.3.6-5.1 on GA media","vulnerabilityIds":["CVE-2024-41110","CVE-2024-45337","CVE-2024-45338","CVE-2025-22869","CVE-2025-22870","CVE-2025-27144"]},{"id":"RHSA-2025:2933","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.18.0","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"RHEA-2025:4438","title":"Red Hat Enhancement Advisory: Red Hat OpenShift Service on AWS 1.0 enhancements","vulnerabilityIds":["CVE-2024-45337","CVE-2025-30204"]},{"id":"RHSA-2025:1710","title":"Red Hat Security Advisory: OpenShift Container Platform 4.15.46 security and extras update","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2024-56326"]},{"id":"RHSA-2025:1326","title":"Red Hat Security Advisory: RHTAS 1.1.1 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2024-45337"]},{"id":"RHEA-2025:15037","title":"Red Hat Enhancement Advisory: OpenShift Virtualization 4.14.14 Images","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2025-22869"]},{"id":"RHEA-2025:13172","title":"Red Hat Enhancement Advisory: OpenShift Virtualization 4.18.12 Images","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2025-22869"]},{"id":"SUSE-SU-2025:0525-1","title":"Security update for SUSE Manager Client Tools","vulnerabilityIds":["CVE-2023-3128","CVE-2023-6152","CVE-2024-22037","CVE-2024-45337","CVE-2024-51744","CVE-2024-6837","CVE-2024-8118"]},{"id":"SUSE-SU-2025:02581-1","title":"Security update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338"]},{"id":"SUSE-SU-2026:21376-1","title":"Security update for google-guest-agent","vulnerabilityIds":["CVE-2023-45288","CVE-2024-45337"]},{"id":"RHSA-2024:11038","title":"Red Hat Security Advisory: OpenShift Container Platform 4.19.0 bug fix and security update","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2025-22868","CVE-2025-22869","CVE-2025-27144","CVE-2025-29781"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2024-3508","identifiers":["EUVD-2024-3508","CVE-2024-45337","GHSA-v778-237x-gjrc"]},"retained":false,"historicalAffected":[]},{"revision":"2401aaba75f34781bba6eaea4d0b2235","observedAt":"2026-10-25T00:17:28.27+00:00","statement":{"source":"nvd","id":"CVE-2024-45337","aliases":[],"title":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call …","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","state":0,"publishedAt":"2024-12-12T02:02:07.97+00:00","modifiedAt":"2026-06-17T07:54:03.36+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1,"severity":"CRITICAL"}],"references":["https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909","https://go.dev/cl/635315","https://go.dev/issue/70779","https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ","https://pkg.go.dev/vuln/GO-2024-3321","http://www.openwall.com/lists/oss-security/2024/12/11/2","https://security.netapp.com/advisory/ntap-20250131-0007/"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-45337","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":[],"productCriteria":[],"sourceDates":{"published":"2024-12-12T02:02:07.970","lastModified":"2026-06-17T07:54:03.360"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2024-45337","identifiers":["CVE-2024-45337"]},"retained":false,"historicalAffected":[]},{"revision":"03f7e2e46b36442887643aa9b93c1e51","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-v778-237x-gjrc","aliases":["CVE-2024-45337","GO-2024-3321"],"title":"Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto","description":"Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.\n\nThe documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.\n\nFor example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.\n\nSince this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.\n\nUsers should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","state":0,"publishedAt":"2024-12-11T22:03:04+00:00","modifiedAt":"2026-09-10T03:50:56.2655462+00:00","affected":[{"ecosystem":"Go","name":"golang.org/x/crypto","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.31.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2024-45337","https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909","https://github.com/golang/crypto","https://go.dev/cl/635315","https://go.dev/issue/70779","https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ","https://pkg.go.dev/vuln/GO-2024-3321","https://security.netapp.com/advisory/ntap-20250131-0007","http://www.openwall.com/lists/oss-security/2024/12/11/2"],"sourceUrl":"https://github.com/advisories/GHSA-v778-237x-gjrc","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-v778-237x-gjrc","identifiers":["GHSA-v778-237x-gjrc","CVE-2024-45337","GO-2024-3321"]},"retained":false,"historicalAffected":[]},{"revision":"b17e025760024eecaf312c6f73d843f7","observedAt":"2026-11-14T13:57:00.683+00:00","statement":{"source":"osv","id":"GO-2024-3321","aliases":["CVE-2024-45337","GHSA-v778-237x-gjrc"],"title":"Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass.\n\nThe documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.\n\nFor example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.\n\nSince this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.\n\nUsers should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","state":0,"publishedAt":"2024-12-11T18:40:19+00:00","modifiedAt":"2026-11-14T13:12:14.7189822+00:00","affected":[{"ecosystem":"Go","name":"golang.org/x/crypto","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.31.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909","https://go.dev/cl/635315","https://go.dev/issue/70779","https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ"],"sourceUrl":"https://osv.dev/vulnerability/GO-2024-3321","license":"OSV · upstream source license applies","key":"osv:GO-2024-3321","identifiers":["GO-2024-3321","CVE-2024-45337","GHSA-v778-237x-gjrc"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T23:06:17.8993558+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T23:06:17.8993558+00:00","lastSuccessAt":"2026-11-15T23:06:18.1032742+00:00","error":null,"lastVerifiedAt":"2026-11-15T23:06:18.1032749+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-39ebbce2db83696403d232c43a03ba55a47d1e19101fb621bbb1e57f01bae099","complete":true,"records":425869,"lastAttemptAt":"2026-11-15T23:06:17.3240958+00:00","lastSuccessAt":"2026-11-15T23:06:17.2976675+00:00","error":null,"lastVerifiedAt":"2026-11-15T23:06:17.3240958+00:00","snapshotPublishedAt":"2026-11-15T22:27:42+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-1f00a6164e4d4eb5b570181d2d48c31d","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T23:16:09.5280366+00:00","lastSuccessAt":"2026-11-15T23:16:09.517+00:00","error":"50 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T23:16:09.517+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13688,"expectedIdentifiers":13874,"failedIdentifiers":50},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T23:06:17.8993558+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T23:06:17.8993558+00:00","lastSuccessAt":"2026-11-15T23:06:18.1046693+00:00","error":null,"lastVerifiedAt":"2026-11-15T23:06:18.1046697+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-41e8388e19074c0d9ced98f4bd388802","complete":true,"records":13833,"lastAttemptAt":"2026-11-15T23:07:00.0091971+00:00","lastSuccessAt":"2026-11-15T23:07:00.006+00:00","error":null,"lastVerifiedAt":"2026-11-15T23:07:00.006+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13874,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T23:06:17.7078343+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T23:06:17.7078343+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T23:06:17.4961704+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T23:06:17.4961704+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-6086d649bcb454cdf302d7d9275177bda73550e1b6e446b3520e9b6266d3582c","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T23:06:17.8235923+00:00","lastSuccessAt":"2026-11-15T11:05:17.1034234+00:00","error":null,"lastVerifiedAt":"2026-11-15T23:06:17.8235923+00:00","snapshotPublishedAt":"2026-11-15T10:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ff18f36f13fcca3a20a3fb9274b59b8872d18869a99071730e1e79b625c8f612","complete":true,"records":232475,"lastAttemptAt":"2026-11-15T23:06:17.6038079+00:00","lastSuccessAt":"2026-11-15T11:05:10.4195883+00:00","error":null,"lastVerifiedAt":"2026-11-15T23:06:17.6038079+00:00","snapshotPublishedAt":"2026-11-15T10:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}