Red Hat Security Advisory

RHSA-2025:1849

RHTAS 1.1.1 - Red Hat Trusted Artifact Signer Release

Released 2025-02-25 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Trusted Artifact Signer 1.1 registry.redhat.io/rhtas/createctconfig-rhel9, registry.redhat.io/rhtas/ctlog-managectroots-rhel9, registry.redhat.io/rhtas/fulcio-createcerts-rhel9 +2

Fixes 1 record

TI-2024-30407 CVE-2024-45337 · GHSA-v778-237x-gjrc

Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto

MEDIUM 53

Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.03181 Published 2024-12-11 Partial fix · 0.31.0 CWE-285