[Bug 1234506] VUL-0: CVE-2024-45337: tailscale: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto

https://bugzilla.suse.com/show_bug.cgi?id=1234506 https://bugzilla.suse.com/show_bug.cgi?id=1234506#c3 --- Comment #3 from Alexandre Vicenzi <alexandre.vicenzi@suse.com> --- The CVE has been addressed by this PR [1] but no new release has been made yet. Based on the PR message, the public key support was a feature that was never used, thus, the code might be affected, but no one used this feature, and it has been entirely removed by this PR. It should be safe to wait for a proper release in the next few days. [1]: https://github.com/tailscale/tailscale/pull/14373 -- You are receiving this mail because: You are on the CC list for the bug.