The vulnerability in golang.org/x/crypto/ssh/knownhosts arises from improper validation of the revocation status of a SignatureKey belonging to a Certificate Authority. Previously, the system did not check if the SignatureKey was revoked, allowing an attacker to bypass security checks by presenting a revoked key. This could lead to acceptance of malicious or spoofed keys, enabling unauthorized access or impersonation of legitimate hosts. The issue is classified as CWE-295 (Improper Certificate Validation) and has a critical CVSS score of 9.1. Red Hat's advisory details the impact and references multiple related CVEs and fixes in the golang.org/x/crypto package, including this one. While fixes are in progress, the advisory does not explicitly confirm patch availability for all affected products, recommending users monitor vendor updates.

The vulnerability allows a remote attacker to bypass security checks by presenting a revoked SignatureKey from a Certificate Authority, which the system incorrectly accepts as valid. This can lead to unauthorized access or spoofing of legitimate entities, compromising confidentiality and integrity of communications. The CVSS score of 9.1 reflects critical impact with no privileges or user interaction required. There are no known exploits in the wild at this time. The flaw affects systems using the golang.org/x/crypto/ssh/knownhosts package that do not properly validate key revocation status.

Red Hat has issued advisories acknowledging the vulnerability and is working on fixes. Users should monitor the Red Hat advisory pages and apply updates once available. The advisory does not explicitly state that a patch is currently available, so patch status is not yet confirmed. Until a fix is applied, users should consider mitigating exposure by restricting access to affected systems and monitoring for suspicious activity related to SSH key usage. Consult the vendor advisory for the latest remediation guidance and update instructions.