Improper authorization in crypto - CVE-2024-45337

Vulnerability identifier: #VU101777

CSH Severity: Medium

CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-45337

CWE-ID: CWE-285

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to gain unauthorized access to the application.

The vulnerability exists due to improper authorization caused by improper usage of the ServerConfig.PublicKeyCallback callback. A remote attacker can bypass authorization in certain cases and gain access to the application.

crypto
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Desktop 12
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Micro
SUSE Manager Client Tools for SLE Micro
SUSE Enterprise Storage
Fedora
Public Cloud Module
SUSE Manager Client Tools for SLE
SUSE Linux Enterprise Server for the Raspberry Pi
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing
Basesystem Module
Containers Module
Desktop Applications Module
SUSE Package Hub 15
HPC Module
openSUSE Leap
Ubuntu
openEuler
Security Verify Access OIDC Provider
prometheus
Cloud Pak for Network Automation
Guardium Data Security Center (GDSC)
Security QRadar EDR
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
DevOps Solution Workbench
Storage Ceph
Maximo Application Suite - Visual Inspection Component
APEX Cloud Platform for Microsoft Azure
Telco Service Design Configuration Designer
Planning Analytics Cartridge for Cloud Pak for Data
Storage Scale
Telco Network Function Virtualization Orchestrator
Storage Protect Server
Robotic Process Automation for Cloud Pak
VolSync
Consul
IBM Concert Software
Netcool Operations Insight
IBM Fusion HCI
IBM Automation Decision Services
IBM Observability with Instana
Multicluster GlobalHub
IBM Cloud Pak for Security
Red Hat Advanced Cluster Management for Kubernetes
APEX Cloud Platform for Red Hat OpenShift
Red Hat OpenShift Dev Spaces
Red Hat Advanced Cluster Security for Kubernetes
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
PowerProtect Data Manager
IBM Cloud Pak for Business Automation
Red Hat OpenShift GitOps
IBM Cloud Pak System
Go LDAP
Splunk Universal Forwarder
Splunk Enterprise
IBM API Connect
golang-go.crypto (Ubuntu package)
golang-github-rclone-gofakes3
govulncheck-vulndb
mgrctl-debuginfo
mgrctl
mgrctl-zsh-completion
mgrctl-bash-completion
mgrctl-lang
firewalld-prometheus-config
dracut-saltboot
golang-github-prometheus-promu
restic
golang-x-crypto
age
supportutils-plugin-salt
apptainer-debuginfo
apptainer
apptainer-sle15_5
apptainer-sle15_6
apptainer-leap
apptainer-sle15_7
kubevirt-virt-exportproxy
kubevirt-virt-controller-debuginfo
kubevirt-tests-debuginfo
kubevirt-virt-operator
kubevirt-virt-api-debuginfo
kubevirt-virt-launcher
kubevirt-container-disk-debuginfo
kubevirt-virt-exportserver
kubevirt-virt-exportserver-debuginfo
kubevirt-virt-exportproxy-debuginfo
kubevirt-virtctl
kubevirt-virt-launcher-debuginfo
kubevirt-container-disk
kubevirt-virt-controller
kubevirt-virt-api
kubevirt-virtctl-debuginfo
kubevirt-pr-helper-conf
kubevirt-tests
kubevirt-virt-handler
kubevirt-manifests
kubevirt-virt-handler-debuginfo
kubevirt-virt-operator-debuginfo
obs-service-kubevirt_containers_meta
opentofu
buildah
buildah-debuginfo
buildah-debugsource
buildah-tests
rclone
doctl
golang-github-prometheus-prometheus
gh
helm-bash-completion
helm-fish-completion
helm-zsh-completion
helm-debuginfo
helm
supportutils-plugin-susemanager-client
spacecmd
golang-github-git-5
incus
grafana
grafana-debuginfo
rime-schema-all
rime-schema-middle-chinese
rime-schema-double-pinyin
rime-schema-array
rime-schema-combo-pinyin
rime-schema-terra-pinyin
rime-schema-prelude
rime-schema-cangjie
rime-schema-stroke
rime-schema-extra
rime-schema-luna-pinyin
rime-schema-pinyin-simp
rime-schema-stenotype
rime-schema-wubi
rime-schema-scj
rime-schema-wugniu
rime-schema-bopomofo
rime-schema-emoji
rime-schema-cantonese
rime-schema-ipa
rime-schema-essay
rime-schema-essay-simp
rime-schema-custom
rime-schema-quick
rime-schema-default
rime-schema-soutzoe
google-guest-agent (Ubuntu package)
golang-github-aws-sdk-2
google-guest-agent
SmartFabric Manager
OpenShift API for Data Protection (OADP)
Multicluster Engine for Kubernetes
Quay
OpenShift Data Foundation (formerly OpenShift Container Storage)
Red Hat OpenShift Container Platform

Install updates from vendor's website.

crypto - update to 0.31.0
VolSync - addressed in versions 0.10.2, 0.11.1
Consul - update to 1.20.2
prometheus - update to 3.1.0
IBM Concert Software - update to 1.1.0
Netcool Operations Insight - update to 1.6.15
Red Hat OpenShift GitOps - addressed in versions 1.16.5, 1.17.3, 1.18.2
IBM Fusion HCI - update to 2.11.0
IBM Cloud Pak System - update to 2.3.6.0
Cloud Pak for Network Automation - update to 2.7.8
Go LDAP - update to 3.4.9
Guardium Data Security Center (GDSC) - update to 3.7.2
Security QRadar EDR - update to 3.12.17
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component - update to 5.1.3
Storage Ceph - update to 8.1z1
Splunk Universal Forwarder - addressed in versions 9.1.9, 9.2.6, 9.3.4, 9.4.2
Splunk Enterprise - addressed in versions 9.1.9, 9.2.6, 9.2.8, 9.3.4, 9.3.6, 9.4.2, 9.4.4, 10.0.1
Maximo Application Suite - Visual Inspection Component - update to 9.1.1
IBM API Connect - update to 10.0.8.2 ifix2
IBM Automation Decision Services - update to 24.0.0.0.4
IBM Observability with Instana - update to 291
golang-go.crypto (Ubuntu package) - addressed in versions 1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm1, 1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm1, 1:0.0~git20200221.2aa609c-1ubuntu0.1~esm1, 1:0.0~git20211202.5770296-1ubuntu0.1~esm1, 1:0.19.0-1ubuntu0.1~esm1
golang-github-rclone-gofakes3 - update to 0.0.3-1.fc42
govulncheck-vulndb - update to 0.0.20250226T025151-150000.1.35.1
mgrctl-debuginfo - addressed in versions 0.1.28-1.16.1, 0.1.28-150000.1.16.1
mgrctl - addressed in versions 0.1.28-1.16.1, 0.1.28-150000.1.16.1
mgrctl-zsh-completion - addressed in versions 0.1.28-1.16.1, 0.1.28-150000.1.16.1
mgrctl-bash-completion - addressed in versions 0.1.28-1.16.1, 0.1.28-150000.1.16.1
mgrctl-lang - update to 0.1.28-150000.1.16.1
firewalld-prometheus-config - update to 0.1-150000.3.59.1
dracut-saltboot - update to 0.1.1728559936.c16d4fb-150000.1.56.1
golang-github-prometheus-promu - addressed in versions 0.17.0-1.24.1, 0.17.0-150000.3.24.1
restic - update to 0.18.0-1.fc43
golang-x-crypto - addressed in versions 0.31.0-2.fc40, 0.31.0-2.fc41
Multicluster GlobalHub - addressed in versions 1.2.1, 1.3.2
age - update to 1.2.1-1.fc41
supportutils-plugin-salt - addressed in versions 1.2.3-6.25.1, 1.2.3-150000.3.16.1
SmartFabric Manager - update to 1.3.0
apptainer-debuginfo - update to 1.3.6-150600.4.9.1
apptainer - update to 1.3.6-150600.4.9.1
apptainer-sle15_5 - update to 1.3.6-150600.4.9.1
apptainer-sle15_6 - update to 1.3.6-150600.4.9.1
apptainer-leap - update to 1.3.6-150600.4.9.1
apptainer-sle15_7 - update to 1.3.6-150600.4.9.1
APEX Cloud Platform for Microsoft Azure - update to 01.04.01.00
kubevirt-virt-exportproxy - update to 1.4.1-150600.5.24.1
kubevirt-virt-controller-debuginfo - update to 1.4.1-150600.5.24.1
kubevirt-tests-debuginfo - update to 1.4.1-150600.5.24.1
kubevirt-virt-operator - update to 1.4.1-150600.5.24.1
kubevirt-virt-api-debuginfo - update to 1.4.1-150600.5.24.1
kubevirt-virt-launcher - update to 1.4.1-150600.5.24.1
kubevirt-container-disk-debuginfo - update to 1.4.1-150600.5.24.1
kubevirt-virt-exportserver - update to 1.4.1-150600.5.24.1
kubevirt-virt-exportserver-debuginfo - update to 1.4.1-150600.5.24.1
kubevirt-virt-exportproxy-debuginfo - update to 1.4.1-150600.5.24.1
kubevirt-virtctl - addressed in versions 1.4.1-150600.5.24.1, 1.5.2-150700.3.5.2
kubevirt-virt-launcher-debuginfo - update to 1.4.1-150600.5.24.1
kubevirt-container-disk - update to 1.4.1-150600.5.24.1
kubevirt-virt-controller - update to 1.4.1-150600.5.24.1
kubevirt-virt-api - update to 1.4.1-150600.5.24.1
kubevirt-virtctl-debuginfo - addressed in versions 1.4.1-150600.5.24.1, 1.5.2-150700.3.5.2
kubevirt-pr-helper-conf - update to 1.4.1-150600.5.24.1
kubevirt-tests - update to 1.4.1-150600.5.24.1
kubevirt-virt-handler - update to 1.4.1-150600.5.24.1
kubevirt-manifests - addressed in versions 1.4.1-150600.5.24.1, 1.5.2-150700.3.5.2
kubevirt-virt-handler-debuginfo - update to 1.4.1-150600.5.24.1
kubevirt-virt-operator-debuginfo - update to 1.4.1-150600.5.24.1
obs-service-kubevirt_containers_meta - update to 1.4.1-150600.5.24.1
OpenShift API for Data Protection (OADP) - update to 1.4.5
opentofu - update to 1.10.3-1.el9
IBM Cloud Pak for Security - update to 1.11.2.0
buildah - addressed in versions 1.26.1-7, 1.34.1-10
buildah-debuginfo - addressed in versions 1.26.1-7, 1.34.1-10
buildah-debugsource - addressed in versions 1.26.1-7, 1.34.1-10
buildah-tests - update to 1.34.1-10
rclone - addressed in versions 1.68.2-1.fc42, 1.70.3-1.el9
doctl - update to 1.120.0-1.fc42
Telco Service Design Configuration Designer - update to 2.3.0
Multicluster Engine for Kubernetes - addressed in versions 2.4.7, 2.5.8, 2.6.5, 2.7.3
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.9.6, 2.10.7, 2.11.5, 2.12.2
golang-github-prometheus-prometheus - addressed in versions 2.53.3-1.56.1, 2.53.3-150000.3.59.1
gh - update to 2.64.0-1.fc42
APEX Cloud Platform for Red Hat OpenShift - addressed in versions 03.01.02.00, 03.02.04.00
Quay - update to 3.9.0
helm-bash-completion - update to 3.17.1-150000.1.41.1
helm-fish-completion - update to 3.17.1-150000.1.41.1
helm-zsh-completion - update to 3.17.1-150000.1.41.1
helm-debuginfo - update to 3.17.1-150000.1.41.1
helm - update to 3.17.1-150000.1.41.1
Red Hat OpenShift Dev Spaces - addressed in versions 3.18.0, 3.21.0
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4, 4.18.0
Red Hat Advanced Cluster Security for Kubernetes - addressed in versions 4.4.8, 4.5.6
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.9
Red Hat OpenShift Container Platform - addressed in versions 4.14.46, 4.14.48, 4.15.44, 4.16.32, 4.17.14, 4.19.0
supportutils-plugin-susemanager-client - addressed in versions 5.0.4-6.33.1, 5.0.4-150000.3.27.1
spacecmd - addressed in versions 5.0.11-38.153.1, 5.0.11-150000.3.130.1
Planning Analytics Cartridge for Cloud Pak for Data - update to 5.1.2
Storage Scale - addressed in versions 5.1.9.9, 5.2.2.1
golang-github-git-5 - update to 5.13.0-1.fc42
incus - update to 6.8-1.fc41
Telco Network Function Virtualization Orchestrator - update to 7.3.0
Storage Protect Server - update to 8.1.26
grafana - addressed in versions 10.4.13-1.66.2, 10.4.13-150000.1.66.1, 10.4.13-150200.3.59.1
grafana-debuginfo - addressed in versions 10.4.13-150000.1.66.1, 10.4.13-150200.3.59.1
PowerProtect Data Manager - update to 19.19.0-15
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF039, 24.0.0-IF004, 24.0.1
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.20, 23.0.20.1
rime-schema-all - update to 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-middle-chinese - update to 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-double-pinyin - update to 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-array - update to 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-combo-pinyin - update to 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-terra-pinyin - update to 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-prelude - update to 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-cangjie - update to 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-stroke - update to 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-extra - update to 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-luna-pinyin - update to 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-pinyin-simp - update to 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-stenotype - update to 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-wubi - update to 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-scj - update to 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-wugniu - update to 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-bopomofo - update to 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-emoji - update to 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-cantonese - update to 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-ipa - update to 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-essay - update to 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-essay-simp - update to 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-custom - update to 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-quick - update to 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-default - update to 20230603+git.5fdd2d6-150600.3.8.1
rime-schema-soutzoe - update to 20230603+git.5fdd2d6-150600.3.8.1
google-guest-agent (Ubuntu package) - addressed in versions 20240716.00-0ubuntu1~16.04.0+esm1, 20241011.01-0ubuntu1~18.04.0+esm1, 20250116.00-0ubuntu1~20.04.0+esm1, 20250116.00-0ubuntu1~22.04.1, 20250116.00-0ubuntu1~24.04.2, 20250116.00-0ubuntu2.1
golang-github-aws-sdk-2 - update to 20250103-1.fc42
google-guest-agent - addressed in versions 20250327.01-1.50.1, 20250327.01-150000.1.60.1

• Exploit #10998 - CVE-2024-45337-POC (December 19, 2024)

• http://www.openwall.com/lists/oss-security/2024/12/11/2
• https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909
• https://go.dev/cl/635315
• https://go.dev/issue/70779
• https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ
• https://pkg.go.dev/vuln/GO-2024-3321
• https://github.com/advisories/GHSA-v778-237x-gjrc

• Improper authorization in Go Crypto package
• Fedora 41 update for golang-x-crypto
• Fedora 40 update for golang-x-crypto
• Fedora 42 update for doctl
• Fedora 41 update for age
• Go LDAP update for x/crypto
• Fedora 41 update for incus
• Fedora 42 update for gh
• Fedora 42 update for golang-github-git-5
• Prometheus update for Go
• Hashicorp Consul update for third-party components
• Fedora 42 update for golang-github-aws-sdk-2, golang-github-rclone-gofakes3, rclone
• Multiple vulnerabilities in VolSync
• Multiple vulnerabilities in VolSync
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.4
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.9
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.5
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.10
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.7
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.6
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.11
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Multicluster GlobalHub 1.2
• Multiple vulnerabilities in Multicluster GlobalHub 1.3
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.12
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces 3.18
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.5
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.4
• SUSE update for grafana
• SUSE update for SUSE Manager Client Tools
• SUSE update for SUSE Manager Client Tools
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• SUSE update for brise
• SUSE update for helm
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage)
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage)
• SUSE update for govulncheck-vulndb
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.18
• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in IBM Planning Analytics Cartridge
• SUSE update for apptainer
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage)
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage)
• SUSE update for google-guest-agent
• SUSE update for google-guest-agent
• Multiple vulnerabilities in IBM Storage Scale
• IBM Storage Protect Server update for Golang Go
• IBM Robotic Process Automation for Cloud Pak update for Go
• Multiple vulnerabilities in IBM Cloud Pak for Security
• Dell APEX Cloud Platform for Red Hat OpenShift update for third-party components
• Multiple vulnerabilities in Dell PowerProtect Data Manager
• Dell APEX Cloud Platform for Microsoft Azure update for third-party components
• IBM Watson Speech Services Cartridge update for Golang Go
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in Dell APEX Cloud Platform for Red Hat OpenShift
• Multiple vulnerabilities in IBM Security QRadar EDR
• Splunk Universal Forwarder update for third-party components
• Splunk Enterprise update for third-party components
• Multiple vulnerabilities in IBM Guardium Data Security Center
• Multiple vulnerabilities in IBM Concert Software
• Dell SmartFabric Manager update for third-party components
• Multiple vulnerabilities in IBM API Connect
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.19
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.19
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM Security Verify Access OIDC Provider
• Fedora 43 update for restic
• Multiple vulnerabilities in HPE Telco Network Function Virtualization Orchestrator Software
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP) 1.4
• Fedora EPEL 9 update for opentofu
• Fedora EPEL 9 update for rclone
• IBM Storage Ceph update for Grafana
• SUSE update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-t
• Multiple vulnerabilities in IBM Automation Decision Services
• IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component update for x/crypto/ssh go library
• Multiple vulnerabilities in IBM Fusion HCI
• openEuler 24.03 LTS SP1 update for buildah
• openEuler 24.03 LTS update for buildah
• openEuler 24.03 LTS SP2 update for buildah
• openEuler 22.03 LTS SP4 update for buildah
• SUSE update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-t
• Splunk Enterprise Security update for third-party components
• Multiple vulnerabilities in IBM Maximo Application Suite - Visual Inspection Component
• Ubuntu update for golang-go.crypto
• Multiple vulnerabilities in IBM DevOps Solution Workbench
• Ubuntu update for google-guest-agent
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in Red Hat Quay
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.16
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.18
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.17
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces 3.21