Skip to main content
CVE-2024-45337VulnerabilityPublished Updated

SUSE · Security update for vexctl

Affects SUSESource GCVE Database

0
Compare

Mentioned vulnerabilities

Not known to be exploited · fixed in SUSE package updates : patch SUSE soon.

Data as of 10 Nov 2026, 20:06 UTC

Severity
High

Rated by Threat Radar · No CVSS score from NVD or the CNA

Patch
Available – fixed in 0.4.4

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 30 Jul 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 10 Nov 2026.

Description

This update for vexctl fixes the following issues: - CVE-2024-45337: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto (bsc#1234486). - CVE-2025-22868: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239186). - CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239323). - CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238683). - CVE-2025-27144: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: Go JOSE's Parsing Vulnerable to Denial of Service (bsc#1237611). - CVE-2025-30204: github.com/golang-jwt/jwt/v4: jwt-go allows excessive memory allocation during header parsing (bsc#1240444). - CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253802). - CVE-2026-22772: github.com/sigstore/fulcio: bypass MetaIssuer URL validation bypass can trigger SSRF to arbitrary internal services (bsc#1256535). - CVE-2026-24137: github.com/sigstore/sigstore/pkg/tuf: legacy TUF client allows for arbitrary file writes with target cache path traversal (bsc#1257138). Changes for vexctl: - Update to version 0.4.4+git20.5d61136: * build(deps): Bump github.com/sigstore/cosign/v2 * build(deps): Bump actions/setup-go from 6.5.0 to 7.0.0 * build(deps): Bump the all group across 1 directory with 5 updates * build(deps): Bump github.com/sigstore/rekor in the all group * build(deps): Bump the all group with 4 updates * build(deps): Bump github.com/google/go-containerregistry * build(deps): Bump actions/setup-go from 6.4.0 to 6.5.0 in the all group * build(deps): Bump the all group across 1 directory with 2 updates * build(deps): Bump actions/checkout from 6.0.3 to 7.0.0 * build(deps): Bump chainguard-dev/actions in the all group - Update to version 0.4.4: * fix signature duplication * fix lints * housekeeping - deps update and ci cleanup * build(deps): Bump the all group with 2 updates * build(deps): Bump github.com/sigstore/sigstore in the all group * build(deps): Bump golangci/golangci-lint-action in the all group - Update to version 0.4.1+git147.b7e6ef0: * build(deps): Bump goreleaser/goreleaser-action in the all group * Bump sigstore/cosign-installer from 4.1.1 to 4.1.2 in the all group * Bump chainguard-dev/actions from 1.6.17 to 1.6.19 in the all group * Bump chainguard-dev/actions from 1.6.16 to 1.6.17 in the all group * Bump github.com/package-url/packageurl-go in the all group * Bump the all group with 2 updates - Update to version 0.4.1+git133.efecaf7: * Bump github.com/secure-systems-lab/go-securesystemslib - Update to version 0.4.1+git129.c7f3066: * Bump github.com/google/go-containerregistry in the all group * Bump github.com/sigstore/timestamp-authority/v2 from 2.0.3 to 2.0.6 * Bump softprops/action-gh-release from 2.6.1 to 3.0.0 * Bump chainguard-dev/actions from 1.6.13 to 1.6.14 in the all group * Bump actions/upload-artifact from 7.0.0 to 7.0.1 in the all group * Bump github.com/sigstore/cosign/v2 from 2.6.2 to 2.6.3 in the all group * Bump kubernetes-sigs/release-actions in the all group * Bump github.com/in-toto/in-toto-golang from 0.9.0 to 0.10.0 * Bump the all group across 1 directory with 2 updates * Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 * fix(add): allow add without --product flag * Use gomod version, bump linter * Port vexctl to intoto/attestation * Bump the all group across 1 directory with 5 updates * Bump google.golang.org/grpc from 1.78.0 to 1.79.3 - Update to version 0.4.1+git96.558125d: * Bump the all group across 1 directory with 3 updates * Bump chainguard-dev/actions from 1.6.5 to 1.6.6 in the all group * Bump github.com/google/go-containerregistry from 0.20.7 to 0.21.0 * Bump actions/upload-artifact from 6.0.0 to 7.0.0 * Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 * Bump chainguard-dev/actions from 1.6.2 to 1.6.4 in the all group - Update to version 0.4.1+git78.f951e3a: * Bump chainguard-dev/actions from 1.6.1 to 1.6.2 in the all group - Update to version 0.4.1+git76.10d7a2e: * Bump chainguard-dev/actions from 1.6.0 to 1.6.1 in the all group * Bump chainguard-dev/actions from 1.5.16 to 1.6.0 in the all group * Bump chainguard-dev/actions from 1.5.14 to 1.5.16 in the all group * Bump chainguard-dev/actions from 1.5.13 to 1.5.14 in the all group * Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 * Bump github.com/theupdateframework/go-tuf/v2 from 2.3.0 to 2.4.1 * Bump actions/setup-go from 6.1.0 to 6.2.0 in the all group * Bump github.com/sigstore/fulcio from 1.8.4 to 1.8.5 * Bump github.com/sigstore/cosign/v2 from 2.6.1 to 2.6.2 in the all group * Bump chainguard-dev/actions from 1.5.10 to 1.5.11 in the all group * Bump github.com/sigstore/fulcio from 1.7.1 to 1.8.3 * Bump github.com/sigstore/sigsto

References

Community reviews

Loading reviews…