{"id":"CVE-2024-45337","aliases":["ALPINE-CVE-2024-45337","AZL-54281","AZL-54286","AZL-54290","AZL-54315","AZL-54317","AZL-54320","AZL-54327","AZL-54330","AZL-54333","AZL-54345","AZL-54353","AZL-54357","AZL-54363","AZL-54372","AZL-54381","AZL-54384","DEBIAN-CVE-2024-45337","EUVD-2024-3508","GHSA-v778-237x-gjrc","GO-2024-3321","MGASA-2026-0147","OESA-2025-2257","OESA-2025-2258","OESA-2025-2259","OESA-2025-2297","RHEA-2025:4438","ROOT-APP-GOBINARY-CVE-2024-45337","SUSE-SU-2025:01985-1","SUSE-SU-2025:02581-1","SUSE-SU-2025:03278-1","SUSE-SU-2025:0524-1","SUSE-SU-2025:0525-1","SUSE-SU-2025:0545-1","SUSE-SU-2025:0601-1","SUSE-SU-2025:0602-1","SUSE-SU-2025:0770-1","SUSE-SU-2025:0980-1","SUSE-SU-2025:1142-1","SUSE-SU-2025:1143-1","SUSE-SU-2025:20196-1","SUSE-SU-2025:20278-1","SUSE-SU-2026:0592-1","SUSE-SU-2026:21319-1","SUSE-SU-2026:21376-1","SUSE-SU-2026:2581-1","SUSE-SU-2026:2612-1","UBUNTU-CVE-2024-45337","USN-7839-1","USN-7839-2","openSUSE-SU-2024:14573-1","openSUSE-SU-2024:14585-1","openSUSE-SU-2024:14590-1","openSUSE-SU-2024:14592-1","openSUSE-SU-2024:14593-1","openSUSE-SU-2024:14595-1","openSUSE-SU-2024:14599-1","openSUSE-SU-2024:14602-1","openSUSE-SU-2024:14604-1","openSUSE-SU-2025:0025-1","openSUSE-SU-2025:0056-1","openSUSE-SU-2025:0094-1","openSUSE-SU-2025:14613-1","openSUSE-SU-2025:14633-1","openSUSE-SU-2025:14641-1","openSUSE-SU-2025:14660-1","openSUSE-SU-2025:14713-1","openSUSE-SU-2025:14902-1","openSUSE-SU-2025:14909-1","openSUSE-SU-2025:14920-1","openSUSE-SU-2025:14969-1","openSUSE-SU-2025:15013-1","openSUSE-SU-2025:15463-1","openSUSE-SU-2025:15779-1","openSUSE-SU-2025:20117-1","openSUSE-SU-2025:20143-1","openSUSE-SU-2026:10230-1","openSUSE-SU-2026:12295-1","openSUSE-SU-2026:12299-1","openSUSE-SU-2026:12300-1","openSUSE-SU-2026:20609-1","openSUSE-SU-2026:20620-1","openSUSE-SU-2026:20730-1","openSUSE-SU-2026:20798-1","openSUSE-SU-2026:20893-1","openSUSE-SU-2026:21481-1","openSUSE-SU-2026:21603-1"],"status":"published","title":"Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.03788,"percentile":0.90051,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-285"],"published":"2024-12-11T18:40:19Z","modified":"2026-11-05T05:40:51Z","exploits":[{"source":"pocgithub","id":"NHAS/CVE-2024-45337-POC","title":"NHAS/CVE-2024-45337-POC","date":"2024-12-17","url":"https://github.com/NHAS/CVE-2024-45337-POC"},{"source":"pocgithub","id":"NHAS/VULNERABLE-CVE-2024-45337","title":"NHAS/VULNERABLE-CVE-2024-45337","date":"2024-12-17","url":"https://github.com/NHAS/VULNERABLE-CVE-2024-45337"},{"source":"pocgithub","id":"peace-maker/CVE-2024-45337","title":"peace-maker/CVE-2024-45337","date":"2025-01-24","url":"https://github.com/peace-maker/CVE-2024-45337"},{"source":"pocgithub","id":"Backline-playground/gogs","title":"Backline-playground/gogs","date":"2026-04-13","url":"https://github.com/Backline-playground/gogs"},{"source":"pocgithub","id":"ferralon-demo/gitea-cve-2024-45337","title":"ferralon-demo/gitea-cve-2024-45337","date":"2026-07-07","url":"https://github.com/ferralon-demo/gitea-cve-2024-45337"}],"fixes":[{"ecosystem":"Go","package":"golang.org/x/crypto","fixed_in":["0.31.0"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.22","package":"rclone","fixed_in":["1.69.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"rclone","fixed_in":["1.69.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"rclone","fixed_in":["1.69.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"telegraf","fixed_in":["1.29.4-10"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"moby-compose","fixed_in":["2.17.3-9"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"packer","fixed_in":["1.9.5-5"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"cert-manager","fixed_in":["1.11.2-16"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"moby-engine","fixed_in":["24.0.9-13"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cf-cli","fixed_in":["8.7.3-4"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"packer","fixed_in":["1.9.5-4"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kubevirt","fixed_in":["1.2.0-11"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"docker-buildx","fixed_in":["0.14.0-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"moby-engine","fixed_in":["25.0.3-9"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"telegraf","fixed_in":["1.31.0-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cert-manager","fixed_in":["1.12.13-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"docker-compose","fixed_in":["2.27.0-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"gh","fixed_in":["2.62.0-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-go.crypto","fixed_in":["1:0.42.0-1"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"golang.org/x/crypto","fixed_in":["v0.31.0-aikido.12","v0.31.0-aikido.10","v0.31.0-aikido.11","v0.31.0-aikido.9","v0.27.0-aikido.1","v0.21.0-aikido.1","v0.27.0-aikido.2","v0.21.0-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"rootio-golang.org/x/crypto","fixed_in":["v0.31.0-root.io.12","v0.31.0-root.io.10","v0.31.0-root.io.11","v0.31.0-root.io.9","v0.27.0-root.io.1","v0.21.0-root.io.1","v0.27.0-root.io.2","v0.21.0-root.io.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"google-guest-agent","fixed_in":["20250327.01-1.50.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"google-guest-agent","fixed_in":["20250327.01-150000.1.60.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP3","package":"google-guest-agent","fixed_in":["20250327.01-150000.1.60.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"google-guest-agent","fixed_in":["20250327.01-150000.1.60.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"google-guest-agent","fixed_in":["20250327.01-150000.1.60.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"google-guest-agent","fixed_in":["20250327.01-150000.1.60.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"google-guest-agent","fixed_in":["20250327.01-150000.1.60.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-go.crypto","fixed_in":["1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"google-guest-agent","fixed_in":["20240716.00-0ubuntu1~16.04.0+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-go.crypto","fixed_in":["1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"google-guest-agent","fixed_in":["20241011.01-0ubuntu1~18.04.0+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"google-guest-agent","fixed_in":["20250116.00-0ubuntu1~20.04.0+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"golang-go.crypto","fixed_in":["1:0.0~git20200221.2aa609c-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"google-guest-agent","fixed_in":["20250116.00-0ubuntu1~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"golang-go.crypto","fixed_in":["1:0.0~git20211202.5770296-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"google-guest-agent","fixed_in":["20250116.00-0ubuntu1~24.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"golang-go.crypto","fixed_in":["1:0.19.0-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"teleport","fixed_in":["17.0.5-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cloudflared","fixed_in":["2024.12.1-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"traefik","fixed_in":["3.2.3-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"git-bug","fixed_in":["0.8.0+git.1733745604.d499b6e-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"helm","fixed_in":["3.16.4-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"traefik2","fixed_in":["2.11.16-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"tailscale","fixed_in":["1.78.3-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"loki","fixed_in":["3.3.2-1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP6","package":"cheat","fixed_in":["4.4.2-bp156.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"cheat","fixed_in":["4.4.2-bp156.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"grafana","fixed_in":["11.3.0-4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"golang-github-prometheus-prometheus","fixed_in":["3.1.0-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"gitleaks","fixed_in":["8.24.2-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"google-guest-agent","fixed_in":["20250327.01-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"gopass","fixed_in":["1.15.16-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"minikube","fixed_in":["1.36.0-2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"golang.org/x/crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.31.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.69.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.69.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.69.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"telegraf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.4-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"moby-compose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.3-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"packer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5-5"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.1.1-26"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"cert-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.2-16"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"moby-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9-13"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cf-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.3-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"packer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-11"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"docker-buildx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.30.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"moby-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.3-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"telegraf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.0-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cert-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.13-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"docker-compose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.0-3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.10.0-1","1:0.12.0-1","1:0.13.0-1","1:0.14.0-1","1:0.16.0-1","1:0.17.0-1","1:0.18.0-1","1:0.19.0-1","1:0.21.0-1","1:0.22.0-1","1:0.23.0-1","1:0.24.0-1","1:0.24.0-2","1:0.25.0-1","1:0.25.0-1~bpo12+1","1:0.33.0-1~exp1","1:0.36.0-1~exp1","1:0.4.0-1","1:0.41.0-1~exp1","1:0.42.0-1","1:0.42.0-1~exp1","1:0.42.0-2","1:0.42.0-3","1:0.42.0-4","1:0.43.0-1","1:0.43.0-2","1:0.45.0-1","1:0.46.0-1","1:0.47.0-1","1:0.50.0-1","1:0.52.0-1","1:0.52.0-1~bpo13+1","1:0.53.0-1","1:0.54.0-1","1:0.55.0-1","1:0.56.0-1","1:0.57.0-1","1:0.57.0-2","1:0.57.0-2~bpo13+1","1:0.58.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.25.0-1","1:0.33.0-1~exp1","1:0.36.0-1~exp1","1:0.41.0-1~exp1","1:0.42.0-1","1:0.42.0-1~exp1","1:0.42.0-2","1:0.42.0-3","1:0.42.0-4","1:0.43.0-1","1:0.43.0-2","1:0.45.0-1","1:0.46.0-1","1:0.47.0-1","1:0.50.0-1","1:0.52.0-1","1:0.52.0-1~bpo13+1","1:0.53.0-1","1:0.54.0-1","1:0.55.0-1","1:0.56.0-1","1:0.57.0-1","1:0.57.0-2","1:0.57.0-2~bpo13+1","1:0.58.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.42.0-1"}]}],"versions":["1:0.25.0-1","1:0.33.0-1~exp1","1:0.36.0-1~exp1","1:0.41.0-1~exp1","1:0.42.0-1~exp1"]},{"source":"osv","ecosystem":"Go","package":"golang.org/x/crypto","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.31.0"}]}]},{"source":"osv","ecosystem":"Go","package":"golang.org/x/crypto","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.31.0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.73.5-1.1.mga9"}]}],"bundled":31},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-10.oe2403sp2"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-10.oe2403"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-10.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-7.oe2203sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift_service_on_aws:1::el8","package":"rosa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.53-5be4e19.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_service_on_aws:1::el8","package":"rosa-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.53-5be4e19.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Go","package":"golang.org/x/crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v0.31.0-aikido.12"},{"fixed":"v0.31.0-aikido.10"},{"fixed":"v0.31.0-aikido.11"},{"fixed":"v0.31.0-aikido.9"},{"fixed":"v0.27.0-aikido.1"},{"fixed":"v0.21.0-aikido.1"},{"fixed":"v0.27.0-aikido.2"},{"fixed":"v0.21.0-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"rootio-golang.org/x/crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v0.31.0-root.io.12"},{"fixed":"v0.31.0-root.io.10"},{"fixed":"v0.31.0-root.io.11"},{"fixed":"v0.31.0-root.io.9"},{"fixed":"v0.27.0-root.io.1"},{"fixed":"v0.21.0-root.io.1"},{"fixed":"v0.27.0-root.io.2"},{"fixed":"v0.21.0-root.io.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"release-notes-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.15.2-150400.3.133.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-150700.3.5.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-150600.5.24.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-150600.5.24.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.53.3-1.56.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"golang-github-prometheus-promu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-1.24.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.4.13-1.66.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.11-38.153.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-6.25.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.4-6.33.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.28-1.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1728559936.c16d4fb-150000.1.56.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.53.3-150000.3.59.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.4.13-150000.1.66.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.11-150000.3.130.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.4-150000.3.27.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.28-150000.1.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1728559936.c16d4fb-150000.1.56.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.28-150000.1.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"golang-github-prometheus-promu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-150000.3.24.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1728559936.c16d4fb-150000.1.56.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-prometheus-promu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-150000.3.24.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.11-150000.3.130.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.4-150000.3.27.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.4.13-150200.3.59.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.4.13-150200.3.59.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"brise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20230603+git.5fdd2d6-150600.3.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"brise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20230603+git.5fdd2d6-150600.3.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.1-150000.1.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.1-150000.1.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.1-150000.1.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.1-150000.1.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.1-150000.1.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.1-150000.1.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.1-150000.1.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.1-150000.1.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.1-150000.1.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.1-150000.1.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.1-150000.1.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.1-150000.1.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.1-150000.1.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.1-150000.1.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.1-150000.1.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.1-150000.1.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250226T025151-150000.1.35.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250226T025151-150000.1.35.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP6","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-150600.4.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-150600.4.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250327.01-1.50.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250327.01-150000.1.60.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP3","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250327.01-150000.1.60.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250327.01-150000.1.60.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250327.01-150000.1.60.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250327.01-150000.1.60.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250327.01-150000.1.60.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.2-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.2-slfo.1.1_1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"vexctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1+git78.f951e3a-150000.1.11.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260529.00-1.61.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260529.00-150000.1.70.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260529.00-150000.1.70.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260529.00-150000.1.70.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260529.00-150000.1.70.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260529.00-150000.1.70.1"}]}],"bundled":22},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm1"}]}],"versions":["1:0.0~git20150608-1","1:0.0~git20151201.0.7b85b09-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20240716.00-0ubuntu1~16.04.0+esm1"}]}],"versions":["20201217.02-0ubuntu1~16.04.0","20230426.00-0ubuntu2~16.04.3","20231004.02-0ubuntu1~16.04.1","20231004.02-0ubuntu1~16.04.2","20240716.00-0ubuntu1~16.04.0"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"lxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.20-0ubuntu4","0.21-0ubuntu3","0.21-0ubuntu5","0.22-0ubuntu1","0.22-0ubuntu2","0.23-0ubuntu1","0.23-0ubuntu2","0.23-0ubuntu3","0.24-0ubuntu2","0.24-0ubuntu3","0.24-0ubuntu4","0.25-0ubuntu1","0.26-0ubuntu2","0.26-0ubuntu3","0.27-0ubuntu1","0.27-0ubuntu2","2.0.0~beta1-0ubuntu3","2.0.0~beta1-0ubuntu4","2.0.0~beta2-0ubuntu1","2.0.0~beta2-0ubuntu2","2.0.0~beta3-0ubuntu1","2.0.0~beta3-0ubuntu2","2.0.0~beta3-0ubuntu3","2.0.0~beta3-0ubuntu4","2.0.0~beta4-0ubuntu1","2.0.0~beta4-0ubuntu2","2.0.0~beta4-0ubuntu3","2.0.0~beta4-0ubuntu4","2.0.0~beta4-0ubuntu5","2.0.0~beta4-0ubuntu6","2.0.0~beta4-0ubuntu7","2.0.0~rc1-0ubuntu1","2.0.0~rc1-0ubuntu2","2.0.0~rc1-0ubuntu3","2.0.0~rc2-0ubuntu2","2.0.0~rc2-0ubuntu3","2.0.0~rc3-0ubuntu1","2.0.0~rc3-0ubuntu2","2.0.0~rc3-0ubuntu3","2.0.0~rc3-0ubuntu4","2.0.0~rc4-0ubuntu1","2.0.0~rc5-0ubuntu1","2.0.0~rc6-0ubuntu1","2.0.0~rc6-0ubuntu2","2.0.0~rc7-0ubuntu1","2.0.0~rc7-0ubuntu2","2.0.0~rc8-0ubuntu1","2.0.0~rc8-0ubuntu2","2.0.0~rc8-0ubuntu3","2.0.0~rc8-0ubuntu5","2.0.0~rc8-0ubuntu6","2.0.0~rc8-0ubuntu7","2.0.0~rc9-0ubuntu2","2.0.0~rc9-0ubuntu3","2.0.0~rc9-0ubuntu4","2.0.0~rc9-0ubuntu5","2.0.0-0ubuntu1","2.0.0-0ubuntu2","2.0.0-0ubuntu3","2.0.0-0ubuntu4","2.0.1-0ubuntu1~16.04.1","2.0.2-0ubuntu1~16.04.1","2.0.3-0ubuntu1~ubuntu16.04.2","2.0.4-0ubuntu1~ubuntu16.04.1","2.0.5-0ubuntu1~ubuntu16.04.1","2.0.8-0ubuntu1~ubuntu16.04.1","2.0.8-0ubuntu1~ubuntu16.04.2","2.0.9-0ubuntu1~16.04.1","2.0.9-0ubuntu1~16.04.2","2.0.10-0ubuntu1~16.04.1","2.0.10-0ubuntu1~16.04.2","2.0.11-0ubuntu1~16.04.2","2.0.11-0ubuntu1~16.04.4","2.0.11-0ubuntu1~16.04.4+esm1","2.0.11-0ubuntu1~16.04.4+esm2","2.0.11-0ubuntu1~16.04.4+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"lxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.18-0ubuntu6","2.19-0ubuntu1","2.20-0ubuntu3","2.20-0ubuntu4","2.21-0ubuntu1","2.21-0ubuntu2","2.21-0ubuntu3","2.21-0ubuntu4","3.0.0~beta2-0ubuntu3","3.0.0~beta3-0ubuntu3","3.0.0~beta5-0ubuntu2","3.0.0~beta7-0ubuntu1","3.0.0-0ubuntu1","3.0.0-0ubuntu2","3.0.0-0ubuntu3","3.0.0-0ubuntu4","3.0.1-0ubuntu1~18.04.1","3.0.2-0ubuntu1~18.04.1","3.0.3-0ubuntu1~18.04.1","3.0.3-0ubuntu1~18.04.2","3.0.3-0ubuntu1~18.04.2+esm1","3.0.3-0ubuntu1~18.04.2+esm2","3.0.3-0ubuntu1~18.04.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm1"}]}],"versions":["1:0.0~git20170629.0.5ef0053-1ubuntu1","1:0.0~git20170629.0.5ef0053-1ubuntu2","1:0.0~git20170629.0.5ef0053-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20241011.01-0ubuntu1~18.04.0+esm1"}]}],"versions":["20201217.02-0ubuntu1~18.04.0","20210414.00-0ubuntu1~18.04.0","20210629.00-0ubuntu1~18.04.1","20220622.00-0ubuntu2~18.04.0","20220622.00-0ubuntu2~18.04.1","20230426.00-0ubuntu2~18.04.0","20231004.02-0ubuntu1~18.04.2","20231004.02-0ubuntu1~18.04.3","20240716.00-0ubuntu1~18.04.0","20241011.01-0ubuntu1~18.04.0"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250116.00-0ubuntu1~20.04.0+esm1"}]}],"versions":["20201217.02-0ubuntu1~20.04.0","20210414.00-0ubuntu1~20.04.0","20210629.00-0ubuntu1~20.04.0","20220622.00-0ubuntu2~20.04.0","20220622.00-0ubuntu2~20.04.2","20230426.00-0ubuntu2~20.04.0","20231004.02-0ubuntu1~20.04.1","20231004.02-0ubuntu1~20.04.2","20231004.02-0ubuntu1~20.04.3","20231004.02-0ubuntu1~20.04.4","20240716.00-0ubuntu1~20.04.0","20241011.01-0ubuntu1~20.04.1","20250116.00-0ubuntu1~20.04.0"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.0~git20200221.2aa609c-1ubuntu0.1~esm1"}]}],"versions":["1:0.0~git20190701.4def268-2","1:0.0~git20200221.2aa609c-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250116.00-0ubuntu1~22.04.1"}]}],"versions":["20210629.00-0ubuntu1","20210629.00-0ubuntu2","20220104.00-0ubuntu1","20220104.00-0ubuntu2","20220622.00-0ubuntu2~22.04.0","20220622.00-0ubuntu2~22.04.1","20230426.00-0ubuntu2~22.04.0","20231004.02-0ubuntu1~22.04.1","20231004.02-0ubuntu1~22.04.2","20231004.02-0ubuntu1~22.04.3","20231004.02-0ubuntu1~22.04.4","20231004.02-0ubuntu1~22.04.5","20240716.00-0ubuntu1~22.04.0","20241011.01-0ubuntu1~22.04.0","20250116.00-0ubuntu1~22.04.0"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.0~git20211202.5770296-1ubuntu0.1~esm1"}]}],"versions":["1:0.0~git20201221.eec23a3-1","1:0.0~git20211202.5770296-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250116.00-0ubuntu1~24.04.2"}]}],"versions":["20230426.00-0ubuntu3","20231004.02-0ubuntu1","20231004.02-0ubuntu3","20240213.00-0ubuntu1","20240213.00-0ubuntu2","20240213.00-0ubuntu3","20240213.00-0ubuntu3.1","20240213.00-0ubuntu3.2","20240716.00-0ubuntu1~24.04.0","20240716.00-0ubuntu1~24.04.1","20241011.01-0ubuntu1~24.04.0","20250116.00-0ubuntu1~24.04.0","20250116.00-0ubuntu1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.19.0-1ubuntu0.1~esm1"}]}],"versions":["1:0.4.0-1","1:0.17.0-1","1:0.18.0-1","1:0.19.0-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.25.0-1","1:0.25.0-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm1"}]}],"versions":["1:0.0~git20150608-1","1:0.0~git20151201.0.7b85b09-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm1"}]}],"versions":["1:0.0~git20170629.0.5ef0053-1ubuntu1","1:0.0~git20170629.0.5ef0053-1ubuntu2","1:0.0~git20170629.0.5ef0053-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.0~git20200221.2aa609c-1ubuntu0.1~esm1"}]}],"versions":["1:0.0~git20190701.4def268-2","1:0.0~git20200221.2aa609c-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.0~git20211202.5770296-1ubuntu0.1~esm1"}]}],"versions":["1:0.0~git20201221.eec23a3-1","1:0.0~git20211202.5770296-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"golang-go.crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.19.0-1ubuntu0.1~esm1"}]}],"versions":["1:0.4.0-1","1:0.17.0-1","1:0.18.0-1","1:0.19.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20240716.00-0ubuntu1~16.04.0+esm1"}]}],"versions":["20201217.02-0ubuntu1~16.04.0","20230426.00-0ubuntu2~16.04.3","20231004.02-0ubuntu1~16.04.1","20231004.02-0ubuntu1~16.04.2","20240716.00-0ubuntu1~16.04.0"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20241011.01-0ubuntu1~18.04.0+esm1"}]}],"versions":["20201217.02-0ubuntu1~18.04.0","20210414.00-0ubuntu1~18.04.0","20210629.00-0ubuntu1~18.04.1","20220622.00-0ubuntu2~18.04.0","20220622.00-0ubuntu2~18.04.1","20230426.00-0ubuntu2~18.04.0","20231004.02-0ubuntu1~18.04.2","20231004.02-0ubuntu1~18.04.3","20240716.00-0ubuntu1~18.04.0","20241011.01-0ubuntu1~18.04.0"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250116.00-0ubuntu1~20.04.0+esm1"}]}],"versions":["20201217.02-0ubuntu1~20.04.0","20210414.00-0ubuntu1~20.04.0","20210629.00-0ubuntu1~20.04.0","20220622.00-0ubuntu2~20.04.0","20220622.00-0ubuntu2~20.04.2","20230426.00-0ubuntu2~20.04.0","20231004.02-0ubuntu1~20.04.1","20231004.02-0ubuntu1~20.04.2","20231004.02-0ubuntu1~20.04.3","20231004.02-0ubuntu1~20.04.4","20240716.00-0ubuntu1~20.04.0","20241011.01-0ubuntu1~20.04.1","20250116.00-0ubuntu1~20.04.0"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250116.00-0ubuntu1~22.04.1"}]}],"versions":["20210629.00-0ubuntu1","20210629.00-0ubuntu2","20220104.00-0ubuntu1","20220104.00-0ubuntu2","20220622.00-0ubuntu2~22.04.0","20220622.00-0ubuntu2~22.04.1","20230426.00-0ubuntu2~22.04.0","20231004.02-0ubuntu1~22.04.1","20231004.02-0ubuntu1~22.04.2","20231004.02-0ubuntu1~22.04.3","20231004.02-0ubuntu1~22.04.4","20231004.02-0ubuntu1~22.04.5","20240716.00-0ubuntu1~22.04.0","20241011.01-0ubuntu1~22.04.0","20250116.00-0ubuntu1~22.04.0"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250116.00-0ubuntu1~24.04.2"}]}],"versions":["20230426.00-0ubuntu3","20231004.02-0ubuntu1","20231004.02-0ubuntu3","20240213.00-0ubuntu1","20240213.00-0ubuntu2","20240213.00-0ubuntu3","20240213.00-0ubuntu3.1","20240213.00-0ubuntu3.2","20240716.00-0ubuntu1~24.04.0","20240716.00-0ubuntu1~24.04.1","20241011.01-0ubuntu1~24.04.0","20250116.00-0ubuntu1~24.04.0","20250116.00-0ubuntu1~24.04.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"teleport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.5-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cloudflared","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.12.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"traefik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"git-bug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0+git.1733745604.d499b6e-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.4-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"traefik2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.16-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241213T205935-1.1"}]}],"bundled":21},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tailscale","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.78.3-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"loki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"cheat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.2-bp156.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"cheat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.2-bp156.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.58.2-bp156.2.6.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.58.2-bp156.2.6.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"gitea-tea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-bp156.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"gitea-tea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-bp156.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"velero","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.1-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.3.0-4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.69.0-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.58.2-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rime-plum-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apptainer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-5.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gitleaks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.24.2-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250327.01-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gopass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.16-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"minikube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.2-1.1"}]}],"bundled":20},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"git-bug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-bp160.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"vexctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1+git78.f951e3a-1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"k3sup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.14-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kubeseal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.41.1-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kumactl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-1.1"}]}],"bundled":14},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"google-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250506.01-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"vexctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4+git20.5d61136-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gitea-tea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.1-bp160.1.1"}]}],"bundled":7}],"products":[{"vendor":"golang.org/x/crypto","product":"golang.org/x/crypto/ssh"}],"references":[{"url":"https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909","tags":["fix","web","article"]},{"url":"https://go.dev/cl/635315","tags":["web","fix","article","report"]},{"url":"https://go.dev/issue/70779","tags":["web","report","article"]},{"url":"https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ","tags":["web","article","report"]},{"url":"https://pkg.go.dev/vuln/GO-2024-3321","tags":["web","advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2024/12/11/2","tags":["web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20250131-0007/","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45337","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20250131-0007","tags":["web"]},{"url":"https://github.com/advisories/GHSA-v778-237x-gjrc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-45337","tags":["advisory"]},{"url":"https://pkg.go.dev","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45337.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-45337","tags":["advisory"]},{"url":"https://github.com/golang/crypto","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2026-0147.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33808","tags":["report"]},{"url":"https://rclone.org/changelog/#v1-73-5-2026-04-19","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-73-4-2026-04-08","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-73-3-2026-03-23","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-73-2-2026-03-06","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-73-1-2026-02-17","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-73-0-2026-01-30","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-72-1-2025-12-10","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-72-0-2025-11-21","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-71-2-2025-10-20","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-71-1-2025-09-24","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-71-0-2025-08-22","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-70-3-2025-07-09","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-70-2-2025-06-27","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-70-1-2025-06-19","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-70-0-2025-06-17","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-69-3-2025-05-21","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-69-2-2025-05-01","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-69-1-2025-02-14","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-69-0-2025-01-12","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-68-2-2024-11-15","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-68-1-2024-09-24","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-68-0-2024-09-08","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-67-0-2024-06-14","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-66-0-2024-03-10","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-65-2-2024-01-24","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-65-1-2024-01-08","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-65-0-2023-11-26","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-64-2-2023-10-19","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-64-1-2023-10-17","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-64-0-2023-09-11","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-63-1-2023-07-17","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-63-0-2023-06-30","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-62-2-2023-03-16","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2257","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9341","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9407","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2258","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27144","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2259","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2297","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11218","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22869","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHEA-2025:4438","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/OCM-14567","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCM-14796","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCM-14846","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCM-14864","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCM-14892","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCM-14948","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCM-15159","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCM-4667","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCM-9780","tags":["article"]},{"url":"https://issues.redhat.com/browse/OSD-28968","tags":["article"]},{"url":"https://issues.redhat.com/browse/ROSAENG-16904","tags":["article"]},{"url":"https://issues.redhat.com/browse/ROSAENG-17384","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhea-2025_4438.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-45337","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331720","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-45337","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-30204","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2354195","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-30204","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30204","tags":["advisory"]},{"url":"https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3","tags":["article"]},{"url":"https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-3553","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501985-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-51744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4123","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502581-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1232762","tags":["report"]},{"url":"https://bugzilla.suse.com/1234537","tags":["report"]},{"url":"https://bugzilla.suse.com/1235303","tags":["report"]},{"url":"https://bugzilla.suse.com/1237270","tags":["report"]},{"url":"https://bugzilla.suse.com/1244486","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45338","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503278-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1241772","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250524-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1212641","tags":["report"]},{"url":"https://bugzilla.suse.com/1219912","tags":["report"]},{"url":"https://bugzilla.suse.com/1229079","tags":["report"]},{"url":"https://bugzilla.suse.com/1229104","tags":["report"]},{"url":"https://bugzilla.suse.com/1231024","tags":["report"]},{"url":"https://bugzilla.suse.com/1231497","tags":["report"]},{"url":"https://bugzilla.suse.com/1231568","tags":["report"]},{"url":"https://bugzilla.suse.com/1231759","tags":["report"]},{"url":"https://bugzilla.suse.com/1232575","tags":["report"]},{"url":"https://bugzilla.suse.com/1232769","tags":["report"]},{"url":"https://bugzilla.suse.com/1232817","tags":["report"]},{"url":"https://bugzilla.suse.com/1232970","tags":["report"]},{"url":"https://bugzilla.suse.com/1233202","tags":["report"]},{"url":"https://bugzilla.suse.com/1233279","tags":["report"]},{"url":"https://bugzilla.suse.com/1233630","tags":["report"]},{"url":"https://bugzilla.suse.com/1233660","tags":["report"]},{"url":"https://bugzilla.suse.com/1234123","tags":["report"]},{"url":"https://bugzilla.suse.com/1234554","tags":["report"]},{"url":"https://bugzilla.suse.com/1235145","tags":["report"]},{"url":"https://bugzilla.suse.com/1236301","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8118","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250525-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250545-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250601-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234597","tags":["report"]},{"url":"https://bugzilla.suse.com/1235573","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21613","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250602-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234482","tags":["report"]},{"url":"https://bugzilla.suse.com/1235318","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250770-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250980-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1228324","tags":["report"]},{"url":"https://bugzilla.suse.com/1234595","tags":["report"]},{"url":"https://bugzilla.suse.com/1234794","tags":["report"]},{"url":"https://bugzilla.suse.com/1237679","tags":["report"]},{"url":"https://bugzilla.suse.com/1238611","tags":["report"]},{"url":"https://bugzilla.suse.com/1239341","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41110","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251142-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234563","tags":["report"]},{"url":"https://bugzilla.suse.com/1239763","tags":["report"]},{"url":"https://bugzilla.suse.com/1239866","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251143-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520196-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1219969","tags":["report"]},{"url":"https://bugzilla.suse.com/1220207","tags":["report"]},{"url":"https://bugzilla.suse.com/1238688","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26147","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520278-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260592-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234486","tags":["report"]},{"url":"https://bugzilla.suse.com/1237611","tags":["report"]},{"url":"https://bugzilla.suse.com/1238683","tags":["report"]},{"url":"https://bugzilla.suse.com/1239186","tags":["report"]},{"url":"https://bugzilla.suse.com/1239323","tags":["report"]},{"url":"https://bugzilla.suse.com/1240444","tags":["report"]},{"url":"https://bugzilla.suse.com/1253802","tags":["report"]},{"url":"https://bugzilla.suse.com/1256535","tags":["report"]},{"url":"https://bugzilla.suse.com/1257138","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24137","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621319-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236533","tags":["report"]},{"url":"https://bugzilla.suse.com/1243254","tags":["report"]},{"url":"https://bugzilla.suse.com/1243505","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621376-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262581-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1210938","tags":["report"]},{"url":"https://bugzilla.suse.com/1239334","tags":["report"]},{"url":"https://bugzilla.suse.com/1239944","tags":["report"]},{"url":"https://bugzilla.suse.com/1245759","tags":["report"]},{"url":"https://bugzilla.suse.com/1253889","tags":["report"]},{"url":"https://bugzilla.suse.com/1257010","tags":["report"]},{"url":"https://bugzilla.suse.com/1260264","tags":["report"]},{"url":"https://bugzilla.suse.com/1262926","tags":["report"]},{"url":"https://bugzilla.suse.com/1265762","tags":["report"]},{"url":"https://bugzilla.suse.com/1266171","tags":["report"]},{"url":"https://bugzilla.suse.com/1266603","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46598","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262612-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-45337","tags":["report"]},{"url":"https://go-review.googlesource.com/c/crypto/+/635315/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7839-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7839-2","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3VJBDKTY25NRJXFRK6QZSRH6ZRBUV2UT/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RFAKX3BHM5IEGVFZW5ORK472VJQ7GAKL/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XRFL3E5J4TDRJ22WLK6BNXDRPBVNWDKW/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/AAHWJCS7IRD2RDUFE5DZXZ6M6SOGWYEK/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RQIXFLKNJXAP2G3IJXYD2WY62FHMR5IX/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QTUY324RV3FFZBHVIWDHRCIOPJHIJIN4/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-26248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55660","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KJENUST4DVKPMGTJHYGQFE57E55AQQDC/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/V7MPKXR7TT2G72ERR2OMAC2SJ3BTV5F6/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234584","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUNHR7ATZWEF5LQKUNEXKL22CUQAND3A/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227010","tags":["report"]},{"url":"https://bugzilla.suse.com/1234512","tags":["report"]},{"url":"https://bugzilla.suse.com/1235265","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21614","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LKOLRH73CIQLMQ327IYGUHNSFKCU5MPI/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234598","tags":["report"]},{"url":"https://bugzilla.suse.com/1235367","tags":["report"]},{"url":"https://bugzilla.suse.com/1239493","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/72PNSQCBBGVVNI7VQE3WSCUAIHCZLRVQ/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VJK5RQOOJ3Q26ODJIGOXXYOYQDDEQ3UX/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MCLAZVPDAT5UFMI67YRTRQBKGNJYHBIS/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LW4KB34TW645AUU7ROKPDCHUTXLGZZBG/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JZAWXH6WKGE2WACLTZWYMHTDCJMU3X6R/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2161","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BIPGSRATX6BG2ZXWE7566EGQCKXLC4RV/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OAFVZYRPJ63SNIOTJJCDPNRWHGLE355Q/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HSLGKMFCTSANXEKOHC36CPS5WHI66Y6L/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HL46ARER7ICEJBIK62L5XG52R6FHUFHU/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]},{"url":"https://bugzilla.suse.com/1232948","tags":["report"]},{"url":"https://bugzilla.suse.com/1237618","tags":["report"]},{"url":"https://bugzilla.suse.com/1239225","tags":["report"]},{"url":"https://bugzilla.suse.com/1239385","tags":["report"]},{"url":"https://bugzilla.suse.com/1240466","tags":["report"]},{"url":"https://bugzilla.suse.com/1241724","tags":["report"]},{"url":"https://bugzilla.suse.com/1243633","tags":["report"]},{"url":"https://bugzilla.suse.com/1246151","tags":["report"]},{"url":"https://bugzilla.suse.com/1246730","tags":["report"]},{"url":"https://bugzilla.suse.com/1248897","tags":["report"]},{"url":"https://bugzilla.suse.com/1248937","tags":["report"]},{"url":"https://bugzilla.suse.com/1250625","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58058","tags":["web"]},{"url":"https://bugzilla.suse.com/1234565","tags":["report"]},{"url":"https://bugzilla.suse.com/1239494","tags":["report"]},{"url":"https://bugzilla.suse.com/1251463","tags":["report"]},{"url":"https://bugzilla.suse.com/1251664","tags":["report"]},{"url":"https://bugzilla.suse.com/1253506","tags":["report"]},{"url":"https://bugzilla.suse.com/1253930","tags":["report"]},{"url":"https://bugzilla.suse.com/1254084","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41178","tags":["web"]},{"url":"https://bugzilla.suse.com/1232964","tags":["report"]},{"url":"https://bugzilla.suse.com/1233422","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41179","tags":["web"]},{"url":"https://bugzilla.suse.com/1235211","tags":["report"]},{"url":"https://bugzilla.suse.com/1236528","tags":["report"]},{"url":"https://bugzilla.suse.com/1253924","tags":["report"]},{"url":"https://bugzilla.suse.com/1255462","tags":["report"]},{"url":"https://bugzilla.suse.com/1258047","tags":["report"]},{"url":"https://bugzilla.suse.com/1258048","tags":["report"]},{"url":"https://bugzilla.suse.com/1260311","tags":["report"]},{"url":"https://bugzilla.suse.com/1262956","tags":["report"]},{"url":"https://bugzilla.suse.com/1264177","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-65105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8556","tags":["web"]},{"url":"https://bugzilla.suse.com/1251363","tags":["report"]},{"url":"https://bugzilla.suse.com/1251547","tags":["report"]},{"url":"https://bugzilla.suse.com/1253512","tags":["report"]},{"url":"https://bugzilla.suse.com/1253786","tags":["report"]},{"url":"https://bugzilla.suse.com/1253977","tags":["report"]},{"url":"https://bugzilla.suse.com/1234582","tags":["report"]},{"url":"https://bugzilla.suse.com/1239422","tags":["report"]},{"url":"https://bugzilla.suse.com/1253918","tags":["report"]},{"url":"https://bugzilla.suse.com/1265920","tags":["report"]},{"url":"https://bugzilla.suse.com/1266794","tags":["report"]},{"url":"https://bugzilla.suse.com/1241819","tags":["report"]},{"url":"https://bugzilla.suse.com/1251471","tags":["report"]},{"url":"https://bugzilla.suse.com/1251663","tags":["report"]},{"url":"https://bugzilla.suse.com/1253576","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-45337","title":"Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","status":"published","published":"2024-12-11T18:55:58.506Z","modified":"2025-02-18T20:48:40.404Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"updated_at":"2026-11-02T14:34:08.16279Z"}],"euvd":[{"id":"EUVD-2024-3508","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","status":"published","published":"2024-12-11T18:55:58Z","modified":"2025-02-18T20:48:40Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T20:53:27.843209Z"}],"ghsa":[{"id":"GHSA-v778-237x-gjrc","title":"Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto","description":"Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.\n\nThe documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.\n\nFor example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.\n\nSince this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.\n\nUsers should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","status":"published","published":"2024-12-11T22:03:04Z","modified":"2025-01-31T15:30:44Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:38:28.945236Z"}],"nvd":[{"id":"CVE-2024-45337","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","status":"published","published":"2024-12-12T02:02:07.97Z","modified":"2026-06-17T07:54:03.36Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"updated_at":"2026-11-02T14:10:39.792395Z"}],"osv":[{"id":"ALPINE-CVE-2024-45337","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","status":"published","published":"2024-12-12T02:02:07.97Z","modified":"2026-11-03T06:32:49.938735939Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"CVE-2024-45337","title":"Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","status":"published","published":"2024-12-11T18:55:58.506Z","modified":"2026-10-28T17:27:15.256192014Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:44:42.790566Z"},{"id":"DEBIAN-CVE-2024-45337","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","status":"published","published":"2024-12-12T02:02:07.97Z","modified":"2026-11-02T12:02:49.285021719Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:45:43.473331Z"},{"id":"GHSA-v778-237x-gjrc","title":"Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto","description":"Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.\n\nThe documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.\n\nFor example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.\n\nSince this API is widely misused, as a partial mitigation golang.org/x/crypto@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.\n\nUsers should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","status":"published","published":"2024-12-11T22:03:04Z","modified":"2026-09-10T03:50:56.265546165Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:46:56.981655Z"},{"id":"OESA-2025-2257","title":"buildah security update","description":"The  package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container\u0026amp;apos;s root file system for manipulation * save container\u0026amp;apos;s root file system layer to create a new image * delete a working container or an image\r\n\r\nSecurity Fix(es):\n\nApplications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \u0026quot;A call to this function does not guarantee that the key offered is in fact used to authenticate.\u0026quot; Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/(CVE-2024-45337)\n\nA flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.(CVE-2024-9341)\n\nA vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.(CVE-2024-9407)","status":"published","published":"2025-09-12T11:09:20Z","modified":"2026-08-18T01:19:09.4814701Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2258","title":"buildah security update","description":"The  package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container\u0026amp;apos;s root file system for manipulation * save container\u0026amp;apos;s root file system layer to create a new image * delete a working container or an image\r\n\r\nSecurity Fix(es):\n\nApplications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \u0026quot;A call to this function does not guarantee that the key offered is in fact used to authenticate.\u0026quot; Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/(CVE-2024-45337)\n\nA flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.(CVE-2024-9341)\n\nA vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.(CVE-2024-9407)\n\nGo JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \u0026quot;.\u0026quot;) to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.(CVE-2025-27144)","status":"published","published":"2025-09-12T11:09:20Z","modified":"2026-08-18T01:19:10.865304986Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2259","title":"buildah security update","description":"The  package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container\u0026amp;apos;s root file system for manipulation * save container\u0026amp;apos;s root file system layer to create a new image * delete a working container or an image\r\n\r\nSecurity Fix(es):\n\nApplications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \u0026quot;A call to this function does not guarantee that the key offered is in fact used to authenticate.\u0026quot; Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/(CVE-2024-45337)\n\nA flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.(CVE-2024-9341)\n\nA vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.(CVE-2024-9407)","status":"published","published":"2025-09-12T11:09:20Z","modified":"2026-08-18T01:19:10.783534831Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2297","title":"buildah security update","description":"The  package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container\u0026amp;apos;s root file system for manipulation * save container\u0026amp;apos;s root file system layer to create a new image * delete a working container or an image\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.(CVE-2024-11218)\n\nApplications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \u0026quot;A call to this function does not guarantee that the key offered is in fact used to authenticate.\u0026quot; Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/(CVE-2024-45337)\n\nA flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.(CVE-2024-9341)\n\nA vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.(CVE-2024-9407)\n\nSSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.(CVE-2025-22869)\n\nGo JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \u0026quot;.\u0026quot;) to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.(CVE-2025-27144)","status":"published","published":"2025-09-19T11:09:22Z","modified":"2026-08-18T01:19:10.313388708Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"RHEA-2025:4438","title":"Red Hat Enhancement Advisory: Red Hat OpenShift Service on AWS 1.0 enhancements","status":"published","published":"2026-08-08T10:06:24Z","modified":"2026-10-20T10:03:04Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"ROOT-APP-GOBINARY-CVE-2024-45337","title":"CVE-2024-45337 in golang.org/x/crypto - Patched by Root","description":"Root has patched CVE-2024-45337 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available.","status":"published","published":"2026-10-28T12:19:08Z","modified":"2026-10-28T13:15:13.233712398Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2024-45337","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","status":"published","published":"2024-12-12T02:02:00Z","modified":"2026-07-09T12:46:42.763534575Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:55:02.636559Z"},{"id":"AZL-54281","title":"CVE-2024-45337 affecting package telegraf for versions less than 1.29.4-10","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","status":"published","published":"2024-12-12T02:02:07Z","modified":"2026-04-21T04:35:31.795422Z","updated_at":"2026-11-02T15:28:06.595149Z"},{"id":"AZL-54286","title":"CVE-2024-45337 affecting package moby-compose for versions less than 2.17.3-9","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","status":"published","published":"2024-12-12T02:02:07Z","modified":"2026-04-21T04:35:32.11948Z","updated_at":"2026-11-02T15:28:06.595149Z"},{"id":"AZL-54290","title":"CVE-2024-45337 affecting package packer for versions less than 1.9.5-5","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","status":"published","published":"2024-12-12T02:02:07Z","modified":"2026-04-21T04:35:31.944471Z","updated_at":"2026-11-02T15:28:06.595149Z"},{"id":"AZL-54315","title":"CVE-2024-45337 affecting package podman 4.1.1-26","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","status":"published","published":"2024-12-12T02:02:07Z","modified":"2026-04-21T04:35:32.864515Z","updated_at":"2026-11-02T15:28:06.879785Z"},{"id":"AZL-54317","title":"CVE-2024-45337 affecting package cert-manager for versions less than 1.11.2-16","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","status":"published","published":"2024-12-12T02:02:07Z","modified":"2026-04-21T04:35:32.760339Z","updated_at":"2026-11-02T15:28:06.879785Z"},{"id":"AZL-54320","title":"CVE-2024-45337 affecting package moby-engine for versions less than 24.0.9-13","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","status":"published","published":"2024-12-12T02:02:07Z","modified":"2026-04-21T04:35:32.685041Z","updated_at":"2026-11-02T15:28:06.879785Z"},{"id":"AZL-54327","title":"CVE-2024-45337 affecting package cf-cli for versions less than 8.7.3-4","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","status":"published","published":"2024-12-12T02:02:07Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:20.828909Z"},{"id":"AZL-54330","title":"CVE-2024-45337 affecting package packer for versions less than 1.9.5-4","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","status":"published","published":"2024-12-12T02:02:07Z","modified":"2026-04-21T04:49:52.862892Z","updated_at":"2026-11-02T15:28:06.879785Z"},{"id":"AZL-54333","title":"CVE-2024-45337 affecting package kubevirt for versions less than 1.2.0-11","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","status":"published","published":"2024-12-12T02:02:07Z","modified":"2026-04-21T04:53:58.296801Z","updated_at":"2026-11-02T15:28:06.879785Z"},{"id":"AZL-54345","title":"CVE-2024-45337 affecting package docker-buildx for versions less than 0.14.0-2","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","status":"published","published":"2024-12-12T02:02:07Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:20.828909Z"},{"id":"AZL-54353","title":"CVE-2024-45337 affecting package cri-o 1.30.1-1","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","status":"published","published":"2024-12-12T02:02:07Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:20.828909Z"},{"id":"AZL-54357","title":"CVE-2024-45337 affecting package moby-engine for versions less than 25.0.3-9","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","status":"published","published":"2024-12-12T02:02:07Z","modified":"2026-10-31T15:02:25Z","updated_at":"2026-11-02T15:28:06.879785Z"},{"id":"AZL-54363","title":"CVE-2024-45337 affecting package telegraf for versions less than 1.31.0-3","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","status":"published","published":"2024-12-12T02:02:07Z","modified":"2026-09-22T05:34:53Z","updated_at":"2026-11-02T15:28:06.879785Z"},{"id":"AZL-54372","title":"CVE-2024-45337 affecting package cert-manager for versions less than 1.12.13-2","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","status":"published","published":"2024-12-12T02:02:07Z","modified":"2026-04-21T04:53:48.174323Z","updated_at":"2026-11-02T15:28:06.879785Z"},{"id":"AZL-54381","title":"CVE-2024-45337 affecting package docker-compose for versions less than 2.27.0-2","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","status":"published","published":"2024-12-12T02:02:07Z","modified":"2026-10-31T15:02:25Z","updated_at":"2026-11-02T15:28:06.879785Z"},{"id":"AZL-54384","title":"CVE-2024-45337 affecting package gh for versions less than 2.62.0-3","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","status":"published","published":"2024-12-12T02:02:07Z","modified":"2026-09-08T17:33:11Z","updated_at":"2026-11-02T15:28:06.879785Z"},{"id":"GO-2024-3321","title":"Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass.\n\nThe documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions.\n\nFor example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key.\n\nSince this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth.\n\nUsers should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.","status":"published","published":"2024-12-11T18:40:19Z","modified":"2026-08-08T10:26:52.108556744Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"MGASA-2026-0147","title":"Updated rclone packages fix security vulnerabilities","description":"This update bring new features, bugs and vulnerabilities fixed in rclone\nand golang components used to build it.\n","status":"published","published":"2026-05-18T19:12:53Z","modified":"2026-05-18T19:33:24.032777418Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2024:14573-1","title":"teleport-17.0.5-1.1 on GA media","description":"These are all security issues fixed in the teleport-17.0.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-12T00:00:00Z","modified":"2026-02-04T04:39:46.983682Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2024:14585-1","title":"cloudflared-2024.12.1-1.1 on GA media","description":"These are all security issues fixed in the cloudflared-2024.12.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-16T00:00:00Z","modified":"2026-02-04T03:54:44.250435Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2024:14590-1","title":"traefik-3.2.3-1.1 on GA media","description":"These are all security issues fixed in the traefik-3.2.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-16T00:00:00Z","modified":"2026-02-04T03:53:36.854186Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2024:14592-1","title":"git-bug-0.8.0+git.1733745604.d499b6e-1.1 on GA media","description":"These are all security issues fixed in the git-bug-0.8.0+git.1733745604.d499b6e-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-17T00:00:00Z","modified":"2026-02-04T03:30:26.851355Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2024:14593-1","title":"helm-3.16.4-1.1 on GA media","description":"These are all security issues fixed in the helm-3.16.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-17T00:00:00Z","modified":"2025-05-07T18:16:14.924802Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2024:14595-1","title":"traefik2-2.11.16-1.1 on GA media","description":"These are all security issues fixed in the traefik2-2.11.16-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-17T00:00:00Z","modified":"2026-02-04T03:57:18.520004Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2024:14599-1","title":"govulncheck-vulndb-0.0.20241213T205935-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20241213T205935-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-18T00:00:00Z","modified":"2026-02-04T02:20:26.243259Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2024:14602-1","title":"tailscale-1.78.3-2.1 on GA media","description":"These are all security issues fixed in the tailscale-1.78.3-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-18T00:00:00Z","modified":"2026-02-04T03:34:14.108862Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2024:14604-1","title":"logcli-3.3.2-1.1 on GA media","description":"These are all security issues fixed in the logcli-3.3.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-19T00:00:00Z","modified":"2025-05-07T18:16:15.115691Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:0025-1","title":"Security update for cheat","description":"This update for cheat fixes the following issues:\n\n- Update to 4.4.2:\n  * Bump chroma to newest version\n  * Remove plan9 support due to build failure\n  * Upgrade to yaml.v3\n\n- Update to 4.4.1:\n  * Update dependencies\n  * Make minor changes to appease revive (linter)\n\n","status":"published","published":"2025-01-23T19:01:34Z","modified":"2026-02-04T03:17:55.987365Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:0056-1","title":"Security update for trivy","description":"This update for trivy fixes the following issues:\n\nUpdate to version 0.58.2 (\n\n      boo#1234512, CVE-2024-45337,\n      boo#1235265, CVE-2024-45338):\n\n  * fix(misconf): allow null values only for tf variables [backport: release/v0.58] (#8238)\n  * fix(suse): SUSE - update OSType constants and references for compatility [backport: release/v0.58] (#8237)\n  * fix: CVE-2025-21613 and CVE-2025-21614 : go-git: argument injection via the URL field [backport: release/v0.58] (#8215)\n  * fix(sbom): attach nested packages to Application [backport: release/v0.58] (#8168)\n  * fix(python): skip dev group's deps for poetry [backport: release/v0.58] (#8158)\n  * fix(sbom): use root package for `unknown` dependencies (if exists) [backport: release/v0.58] (#8156)\n  * chore(deps): bump `golang.org/x/net` from `v0.32.0` to `v0.33.0` [backport: release/v0.58] (#8142)\n  * chore(deps): bump `github.com/CycloneDX/cyclonedx-go` from `v0.9.1` to `v0.9.2` [backport: release/v0.58] (#8136)\n  * fix(redhat): correct rewriting of recommendations for the same vulnerability [backport: release/v0.58] (#8135)\n  * fix(oracle): add architectures support for advisories [backport: release/v0.58] (#8125)\n  * fix(sbom): fix wrong overwriting of applications obtained from different sbom files but having same app type [backport: release/v0.58] (#8124)\n  * chore(deps): bump golang.org/x/crypto from 0.30.0 to 0.31.0 [backport: release/v0.58] (#8122)\n  * fix: handle `BLOW_UNKNOWN` error to download DBs [backport: release/v0.58] (#8121)\n  * fix(java): correctly overwrite version from depManagement if dependency uses `project.*` props [backport: release/v0.58] (#8119)\n  * release: v0.58.0 [main] (#7874)\n  * fix(misconf): wrap AWS EnvVar to iac types (#7407)\n  * chore(deps): Upgrade trivy-checks (#8018)\n  * refactor(misconf): Remove unused options (#7896)\n  * docs: add terminology page to explain Trivy concepts (#7996)\n  * feat: add `workspaceRelationship` (#7889)\n  * refactor(sbom): simplify relationship generation (#7985)\n  * docs: improve databases documentation (#7732)\n  * refactor: remove support for custom Terraform checks (#7901)\n  * docs: drop AWS account scanning (#7997)\n  * fix(aws): change CPU and Memory type of ContainerDefinition to a string (#7995)\n  * fix(cli): Handle empty ignore files more gracefully (#7962)\n  * fix(misconf): load full Terraform module (#7925)\n  * fix(misconf): properly resolve local Terraform cache (#7983)\n  * refactor(k8s): add v prefix for Go packages (#7839)\n  * test: replace Go checks with Rego (#7867)\n  * feat(misconf): log causes of HCL file parsing errors (#7634)\n  * chore(deps): bump the aws group across 1 directory with 7 updates (#7991)\n  * chore(deps): bump github.com/moby/buildkit from 0.17.0 to 0.17.2 in the docker group across 1 directory (#7990)\n  * chore(deps): update csaf module dependency from csaf-poc to gocsaf (#7992)\n  * chore: downgrade the failed block expand message to debug (#7964)\n  * fix(misconf): do not erase variable type for child modules (#7941)\n  * feat(go): construct dependencies of `go.mod` main module in the parser (#7977)\n  * feat(go): construct dependencies in the parser (#7973)\n  * feat: add cvss v4 score and vector in scan response (#7968)\n  * docs: add `overview` page for `others` (#7972)\n  * fix(sbom): Fixes for Programming Language Vulnerabilities and SBOM Package Maintainer Details (#7871)\n  * feat(suse): Align SUSE/OpenSUSE OS Identifiers (#7965)\n  * chore(deps): bump the common group with 4 updates (#7949)\n  * feat(oracle): add `flavors` support (#7858)\n  * fix(misconf): Update trivy-checks default repo to `mirror.gcr.io` (#7953)\n  * chore(deps): Bump up trivy-checks to v1.3.0 (#7959)\n  * fix(k8s): check all results for vulnerabilities (#7946)\n  * ci(helm): bump Trivy version to 0.57.1 for Trivy Helm Chart 0.9.0 (#7945)\n  * feat(secret): Add built-in secrets rules for Private Packagist (#7826)\n  * docs: Fix broken links (#7900)\n  * docs: fix mistakes/typos (#7942)\n  * feat: Update registry fallbacks (#7679)\n  * fix(alpine): add `UID` for removed packages (#7887)\n  * chore(deps): bump the aws group with 6 updates (#7902)\n  * chore(deps): bump the common group with 6 updates (#7904)\n  * fix(debian): infinite loop (#7928)\n  * fix(redhat): don't return error if `root/buildinfo/content_manifests/` contains files that are not `contentSets` files (#7912)\n  * docs: add note about temporary podman socket (#7921)\n  * docs: combine trivy.dev into trivy docs (#7884)\n  * test: change branch in spdx schema link to check in integration tests (#7935)\n  * docs: add Headlamp to the Trivy Ecosystem page (#7916)\n  * fix(report): handle `git@github.com` schema for misconfigs in `sarif` report (#7898)\n  * chore(k8s): enhance k8s scan log (#6997)\n  * fix(terraform): set null value as fallback for missing variables (#7669)\n  * fix(misconf): handle null properties in CloudFormation templates (#7813)\n  * fix(fs): add missing defered Cleanup() call to post analyzer fs (#7882)\n  * chore(deps): bump the common group across 1 directory with 20 updates (#7876)\n  * chore: bump containerd to v2.0.0 (#7875)\n  * fix: Improve version comparisons when build identifiers are present (#7873)\n  * feat(k8s): add default commands for unknown platform (#7863)\n  * chore(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#7868)\n  * refactor(secret): optimize performance by moving ToLower operation outside loop (#7862)\n  * test: save `containerd` image into archive and use in tests (#7816)\n  * chore(deps): bump the github-actions group across 1 directory with 2 updates (#7854)\n  * chore: bump golangci-lint to v1.61.0 (#7853)\n\n- Update to version 0.57.1:\n  * release: v0.57.1 [release/v0.57] (#7943)\n  * feat: Update registry fallbacks [backport: release/v0.57] (#7944)\n  * fix(redhat): don't return error if `root/buildinfo/content_manifests/` contains files that are not `contentSets` files [backport: release/v0.57] (#7939)\n  * test: change branch in spdx schema link to check in integration tests [backport: release/v0.57] (#7940)\n  * release: v0.57.0 [main] (#7710)\n  * chore: lint `errors.Join` (#7845)\n  * feat(db): append errors (#7843)\n  * docs(java): add info about supported scopes (#7842)\n  * docs: add example of creating whitelist of checks (#7821)\n  * chore(deps): Bump trivy-checks (#7819)\n  * fix(go): Do not trim v prefix from versions in Go Mod Analyzer (#7733)\n  * fix(k8s): skip resources without misconfigs (#7797)\n  * fix(sbom):  use `Annotation` instead of `AttributionTexts` for `SPDX` formats (#7811)\n  * fix(cli): add config name to skip-policy-update alias (#7820)\n  * fix(helm): properly handle multiple archived dependencies (#7782)\n  * refactor(misconf): Deprecate `EXCEPTIONS` for misconfiguration scanning (#7776)\n  * fix(k8s)!: support k8s multi container (#7444)\n  * fix(k8s): support kubernetes v1.31 (#7810)\n  * docs: add Windows install instructions (#7800)\n  * ci(helm): auto public Helm chart after PR merged (#7526)\n  * feat: add end of life date for Ubuntu 24.10 (#7787)\n  * feat(report): update gitlab template to populate operating_system value (#7735)\n  * feat(misconf): Show misconfig ID in output (#7762)\n  * feat(misconf): export unresolvable field of IaC types to Rego (#7765)\n  * refactor(k8s): scan config files as a folder (#7690)\n  * fix(license): fix license normalization for Universal Permissive License (#7766)\n  * fix: enable usestdlibvars linter (#7770)\n  * fix(misconf): properly expand dynamic blocks (#7612)\n  * feat(cyclonedx): add file checksums to `CycloneDX` reports (#7507)\n  * fix(misconf): fix for Azure Storage Account network acls adaptation (#7602)\n  * refactor(misconf): simplify k8s scanner (#7717)\n  * feat(parser): ignore white space in pom.xml files (#7747)\n  * test: use forked images (#7755)\n  * fix(java): correctly inherit `version` and `scope` from upper/root `depManagement` and `dependencies` into parents (#7541)\n  * fix(misconf): check if property is not nil before conversion (#7578)\n  * fix(misconf): change default ACL of digitalocean_spaces_bucket to private (#7577)\n  * feat(misconf): ssl_mode support for GCP SQL DB instance (#7564)\n  * test: define constants for test images (#7739)\n  * docs: add note about disabled DS016 check (#7724)\n  * feat(misconf): public network support for Azure Storage Account (#7601)\n  * feat(cli): rename `trivy auth` to `trivy registry` (#7727)\n  * docs: apt-transport-https is a transitional package (#7678)\n  * refactor(misconf): introduce generic scanner (#7515)\n  * fix(cli): `clean --all` deletes only relevant dirs (#7704)\n  * feat(cli): add `trivy auth` (#7664)\n  * fix(sbom): add options for DBs in private registries (#7660)\n  * docs(report): fix reporting doc format (#7671)\n  * fix(repo): `git clone` output to Stderr (#7561)\n  * fix(redhat): include arch in PURL qualifiers (#7654)\n  * fix(report): Fix invalid URI in SARIF report (#7645)\n  * docs(report): Improve SARIF reporting doc (#7655)\n  * fix(db): fix javadb downloading error handling (#7642)\n  * feat(cli): error out when ignore file cannot be found (#7624)\n\n- Update to version 0.56.2:\n  * release: v0.56.2 [release/v0.56] (#7694)\n  * fix(redhat): include arch in PURL qualifiers [backport: release/v0.56] (#7702)\n  * fix(sbom): add options for DBs in private registries [backport: release/v0.56] (#7691)\n\n- Update to version 0.56.1:\n  * release: v0.56.1 [release/v0.56] (#7648)\n  * fix(db): fix javadb downloading error handling [backport: release/v0.56] (#7646)\n  * release: v0.56.0 [main] (#7447)\n  * fix(misconf): not to warn about missing selectors of libraries (#7638)\n  * feat: support RPM archives (#7628)\n  * fix(secret): change grafana token regex to find them without unquoted (#7627)\n  * fix(misconf): Disable deprecated checks by default (#7632)\n  * chore: add prefixes to log messages (#7625)\n  * feat(misconf): Support `--skip-*` for all included modules  (#7579)\n  * feat: support multiple DB repositories for vulnerability and Java DB (#7605)\n  * ci: don't use cache for `setup-go` (#7622)\n  * test: use loaded image names (#7617)\n  * feat(java): add empty versions if `pom.xml` dependency versions can't be detected (#7520)\n  * feat(secret): enhance secret scanning for python binary files (#7223)\n  * refactor: fix auth error handling (#7615)\n  * ci: split `save` and `restore` cache actions (#7614)\n  * fix(misconf): disable DS016 check for image history analyzer (#7540)\n  * feat(suse): added SUSE Linux Enterprise Micro support (#7294)\n  * feat(misconf): add ability to disable checks by ID (#7536)\n  * fix(misconf): escape all special sequences (#7558)\n  * test: use a local registry for remote scanning (#7607)\n  * fix: allow access to '..' in mapfs (#7575)\n  * fix(db): check `DownloadedAt` for `trivy-java-db` (#7592)\n  * chore(deps): bump the common group across 1 directory with 20 updates (#7604)\n  * ci: add `workflow_dispatch` trigger for test workflow. (#7606)\n  * ci: cache test images for `integration`, `VM` and `module` tests (#7599)\n  * chore(deps): remove broken replaces for opa and discovery (#7600)\n  * docs(misconf): Add more info on how to use arbitrary JSON/YAML scan feat (#7458)\n  * fix(misconf): Fixed scope for China Cloud (#7560)\n  * perf(misconf): use port ranges instead of enumeration (#7549)\n  * fix(sbom): export bom-ref when converting a package to a component (#7340)\n  * refactor(misconf): pass options to Rego scanner as is (#7529)\n  * fix(sbom): parse type `framework` as `library` when unmarshalling `CycloneDX` files (#7527)\n  * chore(deps): bump go-ebs-file (#7513)\n  * fix(misconf): Fix logging typo (#7473)\n  * feat(misconf): Register checks only when needed (#7435)\n  * refactor: split `.egg` and `packaging` analyzers (#7514)\n  * fix(java): use `dependencyManagement` from root/child pom's for dependencies from parents (#7497)\n  * chore(vex): add `CVE-2024-34155`, `CVE-2024-34156` and `CVE-2024-34158` in `trivy.openvex.json` (#7510)\n  * chore(deps): bump alpine from 3.20.0 to 3.20.3 (#7508)\n  * chore(vex): suppress openssl vulnerabilities (#7500)\n  * revert(java): stop supporting of `test` scope for `pom.xml` files (#7488)\n  * docs(db): add a manifest example (#7485)\n  * feat(license): improve license normalization (#7131)\n  * docs(oci): Add a note About the expected Media Type for the Trivy-DB OCI Artifact (#7449)\n  * fix(report): fix error with unmarshal of `ExperimentalModifiedFindings` (#7463)\n  * fix(report): change a receiver of MarshalJSON (#7483)\n  * fix(oracle): Update EOL date for Oracle 7 (#7480)\n  * chore(deps): bump the aws group with 6 updates (#7468)\n  * chore(deps): bump the common group across 1 directory with 19 updates (#7436)\n  * chore(helm): bump up Trivy Helm chart (#7441)\n  * refactor(java): add error/statusCode for logs when we can't get pom.xml/maven-metadata.xml from remote repo (#7451)\n  * fix(license): stop spliting a long license text (#7336)\n  * release: v0.55.0 [main] (#7271)\n  * feat(go): use `toolchain` as `stdlib` version for `go.mod` files (#7163)\n  * fix(license): add license handling to JUnit template (#7409)\n  * feat(java): add `test` scope support for `pom.xml` files (#7414)\n  * chore(deps): Bump trivy-checks and pin OPA (#7427)\n  * fix(helm): explicitly define `kind` and `apiVersion` of `volumeClaimTemplate` element (#7362)\n  * feat(sbom): set User-Agent header on requests to Rekor (#7396)\n  * test: add integration plugin tests (#7299)\n  * fix(nodejs): check all `importers` to detect dev deps from pnpm-lock.yaml file (#7387)\n  * fix: logger initialization before flags parsing (#7372)\n  * fix(aws): handle ECR repositories in different regions (#6217)\n  * fix(misconf): fix infer type for null value (#7424)\n  * fix(secret): use `.eyJ` keyword for JWT secret (#7410)\n  * fix(misconf): do not recreate filesystem map (#7416)\n  * chore(deps): Bump trivy-checks (#7417)\n  * fix(misconf): do not register Rego libs in checks registry (#7420)\n  * fix(sbom): use `NOASSERTION` for licenses fields in SPDX formats (#7403)\n  * feat(report): export modified findings in JSON (#7383)\n  * feat(server): Make Trivy Server Multiplexer Exported (#7389)\n  * chore: update CODEOWNERS (#7398)\n  * fix(secret): use only line with secret for long secret lines (#7412)\n  * chore: fix allow rule of ignoring test files to make it case insensitive (#7415)\n  * feat(misconf): port and protocol support for EC2 networks (#7146)\n  * fix(misconf): do not filter Terraform plan JSON by name (#7406)\n  * feat(misconf): support for ignore by nested attributes (#7205)\n  * fix(misconf): use module to log when metadata retrieval fails (#7405)\n  * fix(report): escape `Message` field in `asff.tpl` template (#7401)\n  * feat(misconf): Add support for using spec from on-disk bundle (#7179)\n  * docs: add pkg flags to config file page (#7370)\n  * feat(python): use minimum version for pip packages (#7348)\n  * fix(misconf): support deprecating for Go checks (#7377)\n  * fix(misconf): init frameworks before updating them (#7376)\n  * feat(misconf): ignore duplicate checks (#7317)\n  * refactor(misconf): use slog (#7295)\n  * chore(deps): bump trivy-checks (#7350)\n  * feat(server): add internal `--path-prefix` flag for client/server mode (#7321)\n  * chore(deps): bump the aws group across 1 directory with 7 updates (#7358)\n  * fix: safely check if the directory exists (#7353)\n  * feat(misconf): variable support for Terraform Plan (#7228)\n  * feat(misconf): scanning support for YAML and JSON (#7311)\n  * fix(misconf): wrap Azure PortRange in iac types (#7357)\n  * refactor(misconf): highlight only affected rows (#7310)\n  * fix(misconf): change default TLS values for the Azure storage account (#7345)\n  * chore(deps): bump the common group with 9 updates (#7333)\n  * docs(misconf): Update callsites to use correct naming (#7335)\n  * docs: update air-gapped docs (#7160)\n  * refactor: replace ftypes.Gradle with packageurl.TypeGradle (#7323)\n  * perf(misconf): optimize work with context (#6968)\n  * docs: update links to packaging.python.org (#7318)\n  * docs: update client/server docs for misconf and license scanning (#7277)\n  * chore(deps): bump the common group across 1 directory with 7 updates (#7305)\n  * feat(misconf): iterator argument support for dynamic blocks (#7236)\n  * fix(misconf): do not set default value for default_cache_behavior (#7234)\n  * feat(misconf): support for policy and bucket grants (#7284)\n  * fix(misconf): load only submodule if it is specified in source (#7112)\n  * perf(misconf): use json.Valid to check validity of JSON (#7308)\n  * refactor(misconf): remove unused universal scanner (#7293)\n  * perf(misconf): do not convert contents of a YAML file to string (#7292)\n  * fix(terraform): add aws_region name to presets (#7184)\n  * docs: add auto-generated config (#7261)\n  * feat(vuln): Add `--detection-priority` flag for accuracy tuning (#7288)\n  * refactor(misconf): remove file filtering from parsers (#7289)\n  * fix(flag): incorrect behavior for deprected flag `--clear-cache` (#7281)\n  * fix(java): Return error when trying to find a remote pom to avoid segfault (#7275)\n  * fix(plugin): do not call GitHub content API for releases and tags (#7274)\n  * feat(vm): support the Ext2/Ext3 filesystems (#6983)\n  * feat(cli)!: delete deprecated SBOM flags (#7266)\n  * feat(vm): Support direct filesystem (#7058)\n\n- Update to version 0.51.1 (boo#1227010, CVE-2024-3817):","status":"published","published":"2025-02-07T11:01:31Z","modified":"2026-02-04T03:23:30.049073Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:0094-1","title":"Security update for gitea-tea","description":"This update for gitea-tea fixes the following issues:\n\n- gitea-te: update newer dependencies to fix security issues (boo#1235367 boo#1239493 boo#1234598)\n","status":"published","published":"2025-03-20T13:01:19Z","modified":"2026-02-04T02:42:52.440908Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:14613-1","title":"velero-1.15.1-1.1 on GA media","description":"These are all security issues fixed in the velero-1.15.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-01T00:00:00Z","modified":"2026-02-04T04:17:20.458789Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:14633-1","title":"grafana-11.3.0-4.1 on GA media","description":"These are all security issues fixed in the grafana-11.3.0-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-12T00:00:00Z","modified":"2026-02-04T03:19:57.25149Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:14641-1","title":"rclone-1.69.0-1.1 on GA media","description":"These are all security issues fixed in the rclone-1.69.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-13T00:00:00Z","modified":"2026-02-04T04:36:54.923986Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:14660-1","title":"golang-github-prometheus-prometheus-3.1.0-1.1 on GA media","description":"These are all security issues fixed in the golang-github-prometheus-prometheus-3.1.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-17T00:00:00Z","modified":"2026-02-04T04:15:11.896893Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:14713-1","title":"trivy-0.58.2-1.1 on GA media","description":"These are all security issues fixed in the trivy-0.58.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-29T00:00:00Z","modified":"2026-02-04T02:45:19.18553Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:14902-1","title":"rime-plum-1.0.3-1.1 on GA media","description":"These are all security issues fixed in the rime-plum-1.0.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-03-17T00:00:00Z","modified":"2026-02-04T02:41:11.300533Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:14909-1","title":"apptainer-1.3.6-5.1 on GA media","description":"These are all security issues fixed in the apptainer-1.3.6-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-03-19T00:00:00Z","modified":"2026-02-04T02:18:32.951912Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:14920-1","title":"gitleaks-8.24.2-1.1 on GA media","description":"These are all security issues fixed in the gitleaks-8.24.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-03-24T00:00:00Z","modified":"2026-02-04T03:17:40.649859Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:14969-1","title":"google-guest-agent-20250327.01-1.1 on GA media","description":"These are all security issues fixed in the google-guest-agent-20250327.01-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-04-04T00:00:00Z","modified":"2026-02-04T02:52:03.725326Z","updated_at":"2026-11-02T16:58:37.399567Z"}]},"sources_more":{"osv":37}}