CVE-2024-45337: 
cAdvisor vulnerability analysis and mitigation

CVE-2024-45337 affects golang.org/x/crypto's SSH implementation, specifically related to the ServerConfig.PublicKeyCallback functionality. The vulnerability was discovered and disclosed on December 11, 2024. The issue affects applications and libraries using golang.org/x/crypto versions prior to v0.31.0. This vulnerability could lead to authorization bypass in SSH server implementations (Golang Announce, Go Issue).

The vulnerability stems from misuse of the ServerConfig.PublicKeyCallback API in SSH server implementations. The SSH protocol allows clients to inquire about public key acceptability before proving private key control. The callback may be called with multiple keys, and the order of keys cannot reliably indicate which key was used for authentication. For example, an attacker could send public keys A and B, authenticate with A, but the application might incorrectly make authorization decisions based on key B, which the attacker doesn't control. The vulnerability has been assigned a CVSS v3.1 base score of 9.1 (CRITICAL) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (NVD).

Successful exploitation of this vulnerability could lead to authorization bypass in affected applications. This could result in unauthorized access, disclosure of sensitive information, and modification of data. The vulnerability particularly affects systems that make security-relevant determinations based on keys passed to PublicKeyCallback (Go Vuln DB).

As a partial mitigation, golang.org/x/crypto@v0.31.0 enforces that the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection when using public key authentication. Users should use the Extensions field of the Permissions return value from authentication callbacks to record authentication attempt data, and retrieve successful authentication state via ServerConn.Permissions. Applications should be updated to version 0.31.0 or later of golang.org/x/crypto (Golang Commit).

The vulnerability was responsibly disclosed by the Platform.sh / Upsun engineering team. The Go Security team has addressed the issue promptly by releasing a new version with mitigations. Various organizations, including NetApp, have issued security advisories to their customers regarding this vulnerability (NetApp Advisory).