csaf_microsoft - msrc_cve-2024-45337

msrc_cve-2024-45337

Vulnerability from csaf_microsoft

Published
2024-12-02 00:00
Modified
2025-04-01 00:00
Summary
Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
Notes
Additional Resources
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle
Disclaimer
The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
JSON
To clipboard
{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2024-45337 Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-45337.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto",
    "tracking": {
      "current_release_date": "2025-04-01T00:00:00.000Z",
      "generator": {
        "date": "2025-10-20T02:41:15.710Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2024-45337",
      "initial_release_date": "2024-12-02T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2024-12-20T00:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2025-04-01T00:00:00.000Z",
          "legacy_version": "1",
          "number": "2",
          "summary": "Information published."
        },
        {
          "date": "2024-12-21T00:00:00.000Z",
          "legacy_version": "2",
          "number": "3",
          "summary": "Information published."
        },
        {
          "date": "2024-12-24T00:00:00.000Z",
          "legacy_version": "3",
          "number": "4",
          "summary": "Information published."
        },
        {
          "date": "2024-12-25T00:00:00.000Z",
          "legacy_version": "4",
          "number": "5",
          "summary": "Information published."
        },
        {
          "date": "2024-12-26T00:00:00.000Z",
          "legacy_version": "5",
          "number": "6",
          "summary": "Information published."
        },
        {
          "date": "2024-12-27T00:00:00.000Z",
          "legacy_version": "6",
          "number": "7",
          "summary": "Information published."
        },
        {
          "date": "2025-01-09T00:00:00.000Z",
          "legacy_version": "7",
          "number": "8",
          "summary": "Information published."
        },
        {
          "date": "2025-01-17T00:00:00.000Z",
          "legacy_version": "8",
          "number": "9",
          "summary": "Information published."
        },
        {
          "date": "2025-03-12T00:00:00.000Z",
          "legacy_version": "9",
          "number": "10",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "10"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2.0",
                "product": {
                  "name": "CBL Mariner 2.0",
                  "product_id": "17086"
                }
              },
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 moby-engine 24.0.9-12",
                "product": {
                  "name": "\u003ccbl2 moby-engine 24.0.9-12",
                  "product_id": "27"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 moby-engine 24.0.9-12",
                "product": {
                  "name": "cbl2 moby-engine 24.0.9-12",
                  "product_id": "17148"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cazl3 moby-engine 25.0.3-9",
                "product": {
                  "name": "\u003cazl3 moby-engine 25.0.3-9",
                  "product_id": "20"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 moby-engine 25.0.3-9",
                "product": {
                  "name": "azl3 moby-engine 25.0.3-9",
                  "product_id": "17533"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cazl3 moby-engine 25.0.3-13",
                "product": {
                  "name": "\u003cazl3 moby-engine 25.0.3-13",
                  "product_id": "7"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 moby-engine 25.0.3-13",
                "product": {
                  "name": "azl3 moby-engine 25.0.3-13",
                  "product_id": "19729"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 moby-engine 24.0.9-16",
                "product": {
                  "name": "\u003ccbl2 moby-engine 24.0.9-16",
                  "product_id": "4"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 moby-engine 24.0.9-16",
                "product": {
                  "name": "cbl2 moby-engine 24.0.9-16",
                  "product_id": "19798"
                }
              }
            ],
            "category": "product_name",
            "name": "moby-engine"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 cert-manager 1.11.2-16",
                "product": {
                  "name": "\u003ccbl2 cert-manager 1.11.2-16",
                  "product_id": "26"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 cert-manager 1.11.2-16",
                "product": {
                  "name": "cbl2 cert-manager 1.11.2-16",
                  "product_id": "17149"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cazl3 cert-manager 1.12.13-2",
                "product": {
                  "name": "\u003cazl3 cert-manager 1.12.13-2",
                  "product_id": "22"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 cert-manager 1.12.13-2",
                "product": {
                  "name": "azl3 cert-manager 1.12.13-2",
                  "product_id": "17531"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 cert-manager 1.11.2-22",
                "product": {
                  "name": "\u003ccbl2 cert-manager 1.11.2-22",
                  "product_id": "3"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 cert-manager 1.11.2-22",
                "product": {
                  "name": "cbl2 cert-manager 1.11.2-22",
                  "product_id": "19817"
                }
              }
            ],
            "category": "product_name",
            "name": "cert-manager"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 moby-compose 2.17.3-9",
                "product": {
                  "name": "\u003ccbl2 moby-compose 2.17.3-9",
                  "product_id": "25"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 moby-compose 2.17.3-9",
                "product": {
                  "name": "cbl2 moby-compose 2.17.3-9",
                  "product_id": "17152"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 moby-compose 2.17.3-10",
                "product": {
                  "name": "\u003ccbl2 moby-compose 2.17.3-10",
                  "product_id": "5"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 moby-compose 2.17.3-10",
                "product": {
                  "name": "cbl2 moby-compose 2.17.3-10",
                  "product_id": "19794"
                }
              }
            ],
            "category": "product_name",
            "name": "moby-compose"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 telegraf 1.29.4-10",
                "product": {
                  "name": "\u003ccbl2 telegraf 1.29.4-10",
                  "product_id": "28"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 telegraf 1.29.4-10",
                "product": {
                  "name": "cbl2 telegraf 1.29.4-10",
                  "product_id": "17129"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cazl3 telegraf 1.31.0-3",
                "product": {
                  "name": "\u003cazl3 telegraf 1.31.0-3",
                  "product_id": "21"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 telegraf 1.31.0-3",
                "product": {
                  "name": "azl3 telegraf 1.31.0-3",
                  "product_id": "17532"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cazl3 telegraf 1.31.0-10",
                "product": {
                  "name": "\u003cazl3 telegraf 1.31.0-10",
                  "product_id": "8"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 telegraf 1.31.0-10",
                "product": {
                  "name": "azl3 telegraf 1.31.0-10",
                  "product_id": "19343"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 telegraf 1.29.4-15",
                "product": {
                  "name": "\u003ccbl2 telegraf 1.29.4-15",
                  "product_id": "6"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 telegraf 1.29.4-15",
                "product": {
                  "name": "cbl2 telegraf 1.29.4-15",
                  "product_id": "19735"
                }
              }
            ],
            "category": "product_name",
            "name": "telegraf"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cazl3 gh 2.62.0-3",
                "product": {
                  "name": "\u003cazl3 gh 2.62.0-3",
                  "product_id": "24"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 gh 2.62.0-3",
                "product": {
                  "name": "azl3 gh 2.62.0-3",
                  "product_id": "17529"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cazl3 gh 2.62.0-8",
                "product": {
                  "name": "\u003cazl3 gh 2.62.0-8",
                  "product_id": "10"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 gh 2.62.0-8",
                "product": {
                  "name": "azl3 gh 2.62.0-8",
                  "product_id": "19338"
                }
              }
            ],
            "category": "product_name",
            "name": "gh"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cazl3 docker-compose 2.27.0-2",
                "product": {
                  "name": "\u003cazl3 docker-compose 2.27.0-2",
                  "product_id": "23"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 docker-compose 2.27.0-2",
                "product": {
                  "name": "azl3 docker-compose 2.27.0-2",
                  "product_id": "17530"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cazl3 docker-compose 2.27.0-5",
                "product": {
                  "name": "\u003cazl3 docker-compose 2.27.0-5",
                  "product_id": "12"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 docker-compose 2.27.0-5",
                "product": {
                  "name": "azl3 docker-compose 2.27.0-5",
                  "product_id": "19334"
                }
              }
            ],
            "category": "product_name",
            "name": "docker-compose"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cazl3 docker-buildx 0.14.0-2",
                "product": {
                  "name": "\u003cazl3 docker-buildx 0.14.0-2",
                  "product_id": "19"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 docker-buildx 0.14.0-2",
                "product": {
                  "name": "azl3 docker-buildx 0.14.0-2",
                  "product_id": "17534"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cazl3 docker-buildx 0.14.0-5",
                "product": {
                  "name": "\u003cazl3 docker-buildx 0.14.0-5",
                  "product_id": "13"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 docker-buildx 0.14.0-5",
                "product": {
                  "name": "azl3 docker-buildx 0.14.0-5",
                  "product_id": "19254"
                }
              }
            ],
            "category": "product_name",
            "name": "docker-buildx"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cazl3 kubevirt 1.2.0-11",
                "product": {
                  "name": "\u003cazl3 kubevirt 1.2.0-11",
                  "product_id": "18"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 kubevirt 1.2.0-11",
                "product": {
                  "name": "azl3 kubevirt 1.2.0-11",
                  "product_id": "17535"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cazl3 kubevirt 1.2.0-17",
                "product": {
                  "name": "\u003cazl3 kubevirt 1.2.0-17",
                  "product_id": "9"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 kubevirt 1.2.0-17",
                "product": {
                  "name": "azl3 kubevirt 1.2.0-17",
                  "product_id": "19339"
                }
              }
            ],
            "category": "product_name",
            "name": "kubevirt"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cazl3 packer 1.9.5-4",
                "product": {
                  "name": "\u003cazl3 packer 1.9.5-4",
                  "product_id": "17"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 packer 1.9.5-4",
                "product": {
                  "name": "azl3 packer 1.9.5-4",
                  "product_id": "17536"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 packer 1.9.5-5",
                "product": {
                  "name": "\u003ccbl2 packer 1.9.5-5",
                  "product_id": "1"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 packer 1.9.5-5",
                "product": {
                  "name": "cbl2 packer 1.9.5-5",
                  "product_id": "19843"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cazl3 packer 1.9.5-6",
                "product": {
                  "name": "\u003cazl3 packer 1.9.5-6",
                  "product_id": "15"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 packer 1.9.5-6",
                "product": {
                  "name": "azl3 packer 1.9.5-6",
                  "product_id": "17759"
                }
              }
            ],
            "category": "product_name",
            "name": "packer"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cazl3 cf-cli 8.7.3-4",
                "product": {
                  "name": "\u003cazl3 cf-cli 8.7.3-4",
                  "product_id": "16"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 cf-cli 8.7.3-4",
                "product": {
                  "name": "azl3 cf-cli 8.7.3-4",
                  "product_id": "17537"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cazl3 cf-cli 8.7.11-3",
                "product": {
                  "name": "\u003cazl3 cf-cli 8.7.11-3",
                  "product_id": "11"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 cf-cli 8.7.11-3",
                "product": {
                  "name": "azl3 cf-cli 8.7.11-3",
                  "product_id": "19337"
                }
              }
            ],
            "category": "product_name",
            "name": "cf-cli"
          },
          {
            "category": "product_name",
            "name": "azl3 libcontainers-common 20240213-3",
            "product": {
              "name": "azl3 libcontainers-common 20240213-3",
              "product_id": "14"
            }
          },
          {
            "category": "product_name",
            "name": "cbl2 kubernetes 1.28.4-17",
            "product": {
              "name": "cbl2 kubernetes 1.28.4-17",
              "product_id": "2"
            }
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 moby-engine 24.0.9-12 as a component of CBL Mariner 2.0",
          "product_id": "17086-27"
        },
        "product_reference": "27",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 moby-engine 24.0.9-12 as a component of CBL Mariner 2.0",
          "product_id": "17148-17086"
        },
        "product_reference": "17148",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 cert-manager 1.11.2-16 as a component of CBL Mariner 2.0",
          "product_id": "17086-26"
        },
        "product_reference": "26",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 cert-manager 1.11.2-16 as a component of CBL Mariner 2.0",
          "product_id": "17149-17086"
        },
        "product_reference": "17149",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 moby-compose 2.17.3-9 as a component of CBL Mariner 2.0",
          "product_id": "17086-25"
        },
        "product_reference": "25",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 moby-compose 2.17.3-9 as a component of CBL Mariner 2.0",
          "product_id": "17152-17086"
        },
        "product_reference": "17152",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 telegraf 1.29.4-10 as a component of CBL Mariner 2.0",
          "product_id": "17086-28"
        },
        "product_reference": "28",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 telegraf 1.29.4-10 as a component of CBL Mariner 2.0",
          "product_id": "17129-17086"
        },
        "product_reference": "17129",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 gh 2.62.0-3 as a component of Azure Linux 3.0",
          "product_id": "17084-24"
        },
        "product_reference": "24",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 gh 2.62.0-3 as a component of Azure Linux 3.0",
          "product_id": "17529-17084"
        },
        "product_reference": "17529",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 docker-compose 2.27.0-2 as a component of Azure Linux 3.0",
          "product_id": "17084-23"
        },
        "product_reference": "23",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 docker-compose 2.27.0-2 as a component of Azure Linux 3.0",
          "product_id": "17530-17084"
        },
        "product_reference": "17530",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 cert-manager 1.12.13-2 as a component of Azure Linux 3.0",
          "product_id": "17084-22"
        },
        "product_reference": "22",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 cert-manager 1.12.13-2 as a component of Azure Linux 3.0",
          "product_id": "17531-17084"
        },
        "product_reference": "17531",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 telegraf 1.31.0-3 as a component of Azure Linux 3.0",
          "product_id": "17084-21"
        },
        "product_reference": "21",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 telegraf 1.31.0-3 as a component of Azure Linux 3.0",
          "product_id": "17532-17084"
        },
        "product_reference": "17532",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 moby-engine 25.0.3-9 as a component of Azure Linux 3.0",
          "product_id": "17084-20"
        },
        "product_reference": "20",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 moby-engine 25.0.3-9 as a component of Azure Linux 3.0",
          "product_id": "17533-17084"
        },
        "product_reference": "17533",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 docker-buildx 0.14.0-2 as a component of Azure Linux 3.0",
          "product_id": "17084-19"
        },
        "product_reference": "19",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 docker-buildx 0.14.0-2 as a component of Azure Linux 3.0",
          "product_id": "17534-17084"
        },
        "product_reference": "17534",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 kubevirt 1.2.0-11 as a component of Azure Linux 3.0",
          "product_id": "17084-18"
        },
        "product_reference": "18",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kubevirt 1.2.0-11 as a component of Azure Linux 3.0",
          "product_id": "17535-17084"
        },
        "product_reference": "17535",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 packer 1.9.5-4 as a component of Azure Linux 3.0",
          "product_id": "17084-17"
        },
        "product_reference": "17",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 packer 1.9.5-4 as a component of Azure Linux 3.0",
          "product_id": "17536-17084"
        },
        "product_reference": "17536",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 cf-cli 8.7.3-4 as a component of Azure Linux 3.0",
          "product_id": "17084-16"
        },
        "product_reference": "16",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 cf-cli 8.7.3-4 as a component of Azure Linux 3.0",
          "product_id": "17537-17084"
        },
        "product_reference": "17537",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 packer 1.9.5-5 as a component of CBL Mariner 2.0",
          "product_id": "17086-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 packer 1.9.5-5 as a component of CBL Mariner 2.0",
          "product_id": "19843-17086"
        },
        "product_reference": "19843",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 kubevirt 1.2.0-17 as a component of Azure Linux 3.0",
          "product_id": "17084-9"
        },
        "product_reference": "9",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kubevirt 1.2.0-17 as a component of Azure Linux 3.0",
          "product_id": "19339-17084"
        },
        "product_reference": "19339",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 libcontainers-common 20240213-3 as a component of Azure Linux 3.0",
          "product_id": "17084-14"
        },
        "product_reference": "14",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 docker-buildx 0.14.0-5 as a component of Azure Linux 3.0",
          "product_id": "17084-13"
        },
        "product_reference": "13",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 docker-buildx 0.14.0-5 as a component of Azure Linux 3.0",
          "product_id": "19254-17084"
        },
        "product_reference": "19254",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 moby-engine 25.0.3-13 as a component of Azure Linux 3.0",
          "product_id": "17084-7"
        },
        "product_reference": "7",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 moby-engine 25.0.3-13 as a component of Azure Linux 3.0",
          "product_id": "19729-17084"
        },
        "product_reference": "19729",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 telegraf 1.31.0-10 as a component of Azure Linux 3.0",
          "product_id": "17084-8"
        },
        "product_reference": "8",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 telegraf 1.31.0-10 as a component of Azure Linux 3.0",
          "product_id": "19343-17084"
        },
        "product_reference": "19343",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 docker-compose 2.27.0-5 as a component of Azure Linux 3.0",
          "product_id": "17084-12"
        },
        "product_reference": "12",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 docker-compose 2.27.0-5 as a component of Azure Linux 3.0",
          "product_id": "19334-17084"
        },
        "product_reference": "19334",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 gh 2.62.0-8 as a component of Azure Linux 3.0",
          "product_id": "17084-10"
        },
        "product_reference": "10",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 gh 2.62.0-8 as a component of Azure Linux 3.0",
          "product_id": "19338-17084"
        },
        "product_reference": "19338",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 kubernetes 1.28.4-17 as a component of CBL Mariner 2.0",
          "product_id": "17086-2"
        },
        "product_reference": "2",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 telegraf 1.29.4-15 as a component of CBL Mariner 2.0",
          "product_id": "17086-6"
        },
        "product_reference": "6",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 telegraf 1.29.4-15 as a component of CBL Mariner 2.0",
          "product_id": "19735-17086"
        },
        "product_reference": "19735",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 moby-compose 2.17.3-10 as a component of CBL Mariner 2.0",
          "product_id": "17086-5"
        },
        "product_reference": "5",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 moby-compose 2.17.3-10 as a component of CBL Mariner 2.0",
          "product_id": "19794-17086"
        },
        "product_reference": "19794",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 cert-manager 1.11.2-22 as a component of CBL Mariner 2.0",
          "product_id": "17086-3"
        },
        "product_reference": "3",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 cert-manager 1.11.2-22 as a component of CBL Mariner 2.0",
          "product_id": "19817-17086"
        },
        "product_reference": "19817",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 moby-engine 24.0.9-16 as a component of CBL Mariner 2.0",
          "product_id": "17086-4"
        },
        "product_reference": "4",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 moby-engine 24.0.9-16 as a component of CBL Mariner 2.0",
          "product_id": "19798-17086"
        },
        "product_reference": "19798",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 cf-cli 8.7.11-3 as a component of Azure Linux 3.0",
          "product_id": "17084-11"
        },
        "product_reference": "11",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 cf-cli 8.7.11-3 as a component of Azure Linux 3.0",
          "product_id": "19337-17084"
        },
        "product_reference": "19337",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 packer 1.9.5-6 as a component of Azure Linux 3.0",
          "product_id": "17084-15"
        },
        "product_reference": "15",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 packer 1.9.5-6 as a component of Azure Linux 3.0",
          "product_id": "17759-17084"
        },
        "product_reference": "17759",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-45337",
      "flags": [
        {
          "label": "component_not_present",
          "product_ids": [
            "17084-14",
            "17086-2"
          ]
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Go",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "fixed": [
          "17148-17086",
          "17149-17086",
          "17152-17086",
          "17129-17086",
          "17529-17084",
          "17530-17084",
          "17531-17084",
          "17532-17084",
          "17533-17084",
          "17534-17084",
          "17535-17084",
          "17536-17084",
          "17537-17084",
          "19843-17086",
          "19339-17084",
          "19254-17084",
          "19729-17084",
          "19343-17084",
          "19334-17084",
          "19338-17084",
          "19735-17086",
          "19794-17086",
          "19817-17086",
          "19798-17086",
          "19337-17084",
          "17759-17084"
        ],
        "known_affected": [
          "17086-27",
          "17086-26",
          "17086-25",
          "17086-28",
          "17084-24",
          "17084-23",
          "17084-22",
          "17084-21",
          "17084-20",
          "17084-19",
          "17084-18",
          "17084-17",
          "17084-16",
          "17086-1",
          "17084-9",
          "17084-13",
          "17084-7",
          "17084-8",
          "17084-12",
          "17084-10",
          "17086-6",
          "17086-5",
          "17086-3",
          "17086-4",
          "17084-11",
          "17084-15"
        ],
        "known_not_affected": [
          "17084-14",
          "17086-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-45337 Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-45337.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-12-20T00:00:00.000Z",
          "details": "24.0.9-12:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17086-27",
            "17086-4"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2024-12-20T00:00:00.000Z",
          "details": "1.11.2-16:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17086-26",
            "17086-3"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2024-12-20T00:00:00.000Z",
          "details": "2.17.3-9:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17086-25",
            "17086-5"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2024-12-20T00:00:00.000Z",
          "details": "1.29.4-10:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17086-28",
            "17086-6"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2024-12-20T00:00:00.000Z",
          "details": "2.62.0-3:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-24",
            "17084-10"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2024-12-20T00:00:00.000Z",
          "details": "2.27.0-2:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-23",
            "17084-12"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2024-12-20T00:00:00.000Z",
          "details": "1.12.13-2:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-22"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2024-12-20T00:00:00.000Z",
          "details": "1.31.0-3:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-21",
            "17084-8"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2024-12-20T00:00:00.000Z",
          "details": "25.0.3-9:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-20",
            "17084-7"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2024-12-20T00:00:00.000Z",
          "details": "0.14.0-2:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-19",
            "17084-13"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2024-12-20T00:00:00.000Z",
          "details": "1.2.0-11:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-18",
            "17084-9"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2024-12-20T00:00:00.000Z",
          "details": "1.9.5-4:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-17"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2024-12-20T00:00:00.000Z",
          "details": "8.7.3-4:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-16",
            "17084-11"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2024-12-20T00:00:00.000Z",
          "details": "1.9.5-5:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17086-1"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2024-12-20T00:00:00.000Z",
          "details": "1.9.5-7:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-15"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.1,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "17086-27",
            "17086-26",
            "17086-25",
            "17086-28",
            "17084-24",
            "17084-23",
            "17084-22",
            "17084-21",
            "17084-20",
            "17084-19",
            "17084-18",
            "17084-17",
            "17084-16",
            "17086-1",
            "17084-9",
            "17084-13",
            "17084-7",
            "17084-8",
            "17084-12",
            "17084-10",
            "17086-6",
            "17086-5",
            "17086-3",
            "17086-4",
            "17084-11",
            "17084-15"
          ]
        }
      ],
      "title": "Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto"
    }
  ]
}
CVE-2024-45337 (GCVE-0-2024-45337)

Vulnerability from cvelistv5

Published
2024-12-11 18:55
Modified
2025-02-18 20:48
Severity ?
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE
CWE-1108: Excessive Reliance on Global Variables
Summary
Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.
References
URL
	Vendor	Product	Version
	golang.org/x/crypto	golang.org/x/crypto/ssh	Version: 0 ≤
Sightings

Author	Source	Type	Date
Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Action not permitted
