Advisory GHSA-v778-237x-gjrc references a vulnerability in the following Go modules:

Description:
Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successf...

References:

• ADVISORY: GHSA-v778-237x-gjrc
• FIX: golang/crypto@b4f1988
• FIX: https://go.dev/cl/635315
• REPORT: https://go.dev/issue/70779
• WEB: https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ

Cross references:

• golang.org/x/crypto appears in 10 other report(s):
  • data/reports/GO-2020-0012.yaml (dummy issue #12)
  • data/reports/GO-2020-0013.yaml (dummy issue #13)
  • data/reports/GO-2021-0227.yaml (x/vulndb: potential Go vuln in Go Standard Library (package not identified): CVE-2020-29652 #227)
  • data/reports/GO-2021-0356.yaml (x/vulndb: potential Go vuln in std: CVE-2022-27191 #356)
  • data/reports/GO-2022-0209.yaml (x/vulndb: potential Go vuln in "Go Standard Library (package not identified)": CVE-2019-11840 #209)
  • data/reports/GO-2022-0229.yaml (x/vulndb: potential Go vuln in Go Standard Library (package not identified): CVE-2020-7919 #229)
  • data/reports/GO-2022-0968.yaml (x/vulndb: potential Go vuln in std: CVE-2021-43565 #968)
  • data/reports/GO-2023-1992.yaml (x/vulndb: potential Go vuln in golang.org/x/crypto/openpgp/clearsign: GHSA-x3jr-pf6g-c48f #1992)
  • data/reports/GO-2023-2402.yaml (x/vulndb: potential Go vuln in golang.org/x/crypto: CVE-2023-48795 #2402)
  • data/reports/GO-2024-2961.yaml (x/vulndb: potential Go vuln in golang.org/x/crypto/acme/autocert: CVE-2022-30636 #2961)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: golang.org/x/crypto
      versions:
        - fixed: 0.31.0
      vulnerable_at: 0.30.0
summary: |-
    Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in
    golang.org/x/crypto
cves:
    - CVE-2024-45337
ghsas:
    - GHSA-v778-237x-gjrc
references:
    - advisory: https://github.com/advisories/GHSA-v778-237x-gjrc
    - fix: https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909
    - fix: https://go.dev/cl/635315
    - report: https://go.dev/issue/70779
    - web: https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ
source:
    id: GHSA-v778-237x-gjrc
    created: 2024-12-11T23:01:13.790921101Z
review_status: UNREVIEWED