Към съдържанието
Търсене

CVE-2026-46595: golang.org/x/crypto/ssh, заобикаляне на вход и права

10.0

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

Засегнати продукти

  • golang.org/x/crypto golang.org/x/crypto/ssh: преди 0.52.0
  • Red Hat Cryostat 4 on RHEL 9: 4.2.0-19 преди *
  • Red Hat RHEM 1.0 for RHEL 9: 0:1.0.3-1.el9em преди *
  • Red Hat RHEM 1.1 for RHEL 10: 0:1.1.3-1.el10em преди *
  • Red Hat RHEM 1.1 for RHEL 9: 0:1.1.3-1.el9em преди *
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.19: 1786613805 преди *
  • Red Hat Cluster Observability Operator 1.5.0: 1787593637 преди *
  • Red Hat DevWorkspace Operator 0.42: 1782401674 преди *
  • Red Hat Logging Subsystem for Red Hat OpenShift 6.6: 1788439505 преди *
  • Red Hat multicluster engine for Kubernetes 2.8: 1782160196 преди *
  • Red Hat OpenShift API for Data Protection 1.3: 1785180878 преди *
  • Red Hat OpenShift API for Data Protection 1.4: 1786944540 преди *
  • Red Hat OpenShift API for Data Protection 1.5: 1788860461 преди *
  • Red Hat OpenShift API for Data Protection 1.6: 1784058822 преди *
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13: 1782383730 преди *
  • Red Hat Red Hat Advanced Cluster Security 4.9: 1781686446 преди *
  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10: 1781686458 преди *
  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.11: 1783352589 преди *
  • Red Hat Red Hat Edge Manager 1.0: 1783502025 преди *
  • Red Hat Red Hat Edge Manager 1.1: 1784196588 преди *
  • Red Hat Red Hat Enterprise Linux AI 3.4: 1782804957 преди *
  • Red Hat Red Hat Hardened Images: 1.25.11-2.hum1 преди *
  • Red Hat Red Hat OpenShift AI 3.3: 1782471656 преди *
  • Red Hat Red Hat OpenShift AI 3.4: 1787089049 преди *
  • Red Hat Red Hat OpenShift Builds 1.7.3: 1783057868 преди *
  • Red Hat Red Hat OpenShift Builds 1.8.1: 1784121108 преди *
  • Red Hat Red Hat Openshift Data Foundation 4.22: 1782932114 преди *
  • Red Hat Red Hat OpenShift Dev Spaces 3.29: 1782403274 преди *
  • Red Hat Red Hat Quay 3.15: 1784351966 преди *
  • Red Hat Red Hat Trusted Artifact Signer 1.4: 4-1.4.2 преди *; 4-1.4.3 преди *
  • Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2
  • Red Hat Confidential Compute Attestation
  • Red Hat ExternalDNS Operator
  • Red Hat External Secrets Operator for Red Hat OpenShift
  • Red Hat Multicluster Engine for Kubernetes
  • Red Hat OpenShift Pipelines
  • Red Hat OpenShift Serverless
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Red Hat Ceph Storage 9
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift for Windows Containers
  • Red Hat Red Hat OpenShift GitOps
  • Red Hat Red Hat OpenShift on AWS
  • Red Hat Red Hat OpenShift Virtualization 4
  • Red Hat Red Hat OpenStack Platform 16.2
  • Red Hat Red Hat OpenStack Platform 17.1
  • Red Hat Red Hat OpenStack Platform 18.0
  • Red Hat Red Hat Quay 3
  • Red Hat Security Profiles Operator
  • Red Hat Zero Trust Workload Identity Manager
  • Red Hat Zero Trust Workload Identity Manager - Tech Preview

Вид слабост

История

  • 22 май 2026 Публикувано

Други уязвимости в golang.org/x/crypto golang.org/x/crypto/ssh

Първоизточници

CVE-2026-46595: golang.org/x/crypto/ssh, заобикаляне на вход и права | freedomonline.bg