x-crypto up to 0.30.x on Go ServerConfig.PublicKeyCallback excessive reliance on global variables

Summaryinfo

A vulnerability was found in x-crypto up to 0.30.x on Go. It has been declared as problematic. Impacted is the function ServerConfig.PublicKeyCallback. Such manipulation leads to excessive reliance on global variables. This vulnerability is referenced as CVE-2024-45337. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in x-crypto up to 0.30.x on Go. Affected by this issue is the function ServerConfig.PublicKeyCallback. The manipulation with an unknown input leads to a excessive reliance on global variables vulnerability. Using CWE to declare the problem leads to CWE-1108. The code is structured in a way that relies too much on using or setting global variables throughout various points in the code, instead of preserving the associated information in a narrower, more local context. The impact remains unknown. CVE summarizes:

Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.

The advisory is available at go.dev. This vulnerability is handled as CVE-2024-45337 since 08/27/2024. Technical details are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 213037 (Fedora 41 : golang-x-crypto (2024-c33c95804e)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.31.0 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (213037) and CERT Bund (WID-SEC-2024-3690). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Amazon Linux 2
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• SUSE Linux
• SUSE openSUSE
• IBM MQ
• Open Source Gitea
• Red Hat OpenShift
• IBM Storage Scale
• Splunk Splunk Enterprise

Productinfo

Name

• x-crypto

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion