Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
The CVSS severity warrants an early asset and exposure review.
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
Confirm exposure before applying a vendor-supported change.
Confirm that golang.org/x/crypto golang.org/x/crypto/ssh, RHEM 1.0 for RHEL 9, RHEM 1.1 for RHEL 10 and an affected version are present.
Combine exploitation signals with asset exposure and business criticality.
Follow the vendor advisory or supported update path and preserve rollback options.
Recheck the version, service health, access paths, and relevant logs.
