CVE-2024-45337 #8514
Open
CVE-2024-45337 #8514
+15
−15
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The change will fix CVE-2023-45288 Vulnerability details: https://nvd.nist.gov/vuln/detail/CVE-2024-45337 Fix: golang/go#70779 Signed-off-by: Kamlesh Verma <[email protected]>
|
/kind changelog-not-required |
github-actions
bot
added
the
Dependencies
github-actions
bot
added
the
kind/changelog-not-required
|
Please signoff all your commits https://github.com/vmware-tanzu/velero/pull/8514/checks?check_run_id=34572716368 and force push. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The change will fix CVE-2023-45288
Vulnerability details: https://nvd.nist.gov/vuln/detail/CVE-2024-45337
Fix: golang/go#70779
Thank you for contributing to Velero!
Please add a summary of your change
As per NVD, Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass.Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key.
Does your change fix a particular issue?
Yes. It will fix CVE-2023-45288 vulnerability.
Fixes #(issue)
Please indicate you've done the following:
make new-changelog) or comment/kind changelog-not-requiredon this PR.site/content/docs/main.