Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2024-45337: golang.org/x/crypto could let attackers run code
CVE-2024-45337 · published 14 days ago
Summary
The Go programming language’s cryptography library (golang.org/x/crypto) was found to have a weakness that could allow an attacker to execute unwanted code. This affects software that includes this library, such as Go‑based tools from Canonical. Apply the latest patched version of the library as soon as possible to eliminate the risk.
What to do
- Update golang.org x to version 0.31.0.
- Update canonical golang-go.crypto to version 1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm1.
- Update canonical google-guest-agent to version 20240716.00-0ubuntu1~16.04.0+esm1.
- Update canonical golang-go.crypto to version 1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm1.
- Update canonical google-guest-agent to version 20241011.01-0ubuntu1~18.04.0+esm1.
- Update canonical google-guest-agent to version 20250116.00-0ubuntu1~20.04.0+esm1.
- Update canonical golang-go.crypto to version 1:0.0~git20200221.2aa609c-1ubuntu0.1~esm1.
- Update canonical google-guest-agent to version 20250116.00-0ubuntu1~22.04.1.
- Update canonical golang-go.crypto to version 1:0.0~git20211202.5770296-1ubuntu0.1~esm1.
- Update canonical google-guest-agent to version 20250116.00-0ubuntu1~24.04.2.
- Update canonical golang-go.crypto to version 1:0.19.0-1ubuntu0.1~esm1.
- Update x golang.org/x/crypto to version v0.31.0-aikido.9.
- Update x rootio-golang.org/x/crypto to version v0.31.0-root.io.9.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | golang.org | x |
< 0.31.0 Fix: upgrade to 0.31.0
|
| Ubuntu:Pro:16.04:LTS | canonical | golang-go.crypto |
< 1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm1 Fix: upgrade to 1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm1
|
| Ubuntu:Pro:16.04:LTS | canonical | google-guest-agent |
< 20240716.00-0ubuntu1~16.04.0+esm1 Fix: upgrade to 20240716.00-0ubuntu1~16.04.0+esm1
|
| Ubuntu:Pro:16.04:LTS | canonical | lxd | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | lxd | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | golang-go.crypto |
< 1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm1 Fix: upgrade to 1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm1
|
| Ubuntu:Pro:18.04:LTS | canonical | google-guest-agent |
< 20241011.01-0ubuntu1~18.04.0+esm1 Fix: upgrade to 20241011.01-0ubuntu1~18.04.0+esm1
|
| Ubuntu:Pro:20.04:LTS | canonical | google-guest-agent |
< 20250116.00-0ubuntu1~20.04.0+esm1 Fix: upgrade to 20250116.00-0ubuntu1~20.04.0+esm1
|
| Ubuntu:Pro:20.04:LTS | canonical | golang-go.crypto |
< 1:0.0~git20200221.2aa609c-1ubuntu0.1~esm1 Fix: upgrade to 1:0.0~git20200221.2aa609c-1ubuntu0.1~esm1
|
| Ubuntu:22.04:LTS | canonical | google-guest-agent |
< 20250116.00-0ubuntu1~22.04.1 Fix: upgrade to 20250116.00-0ubuntu1~22.04.1
|
| Ubuntu:Pro:22.04:LTS | canonical | golang-go.crypto |
< 1:0.0~git20211202.5770296-1ubuntu0.1~esm1 Fix: upgrade to 1:0.0~git20211202.5770296-1ubuntu0.1~esm1
|
| Ubuntu:24.04:LTS | canonical | google-guest-agent |
< 20250116.00-0ubuntu1~24.04.2 Fix: upgrade to 20250116.00-0ubuntu1~24.04.2
|
| Ubuntu:Pro:24.04:LTS | canonical | golang-go.crypto |
< 1:0.19.0-1ubuntu0.1~esm1 Fix: upgrade to 1:0.19.0-1ubuntu0.1~esm1
|
| Ubuntu:25.10 | canonical | golang-go.crypto | All versions |
| Root:Go | x | golang.org/x/crypto |
< v0.31.0-aikido.9 Fix: upgrade to v0.31.0-aikido.9
|
| Root:Go | x | rootio-golang.org/x/crypto |
< v0.31.0-root.io.9 Fix: upgrade to v0.31.0-root.io.9
|
Original advisory text
CVE-2024-45337 in golang.org/x/crypto - Patched by Root
Root has patched CVE-2024-45337 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available.
References
- https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909
- https://nvd.nist.gov/vuln/detail/CVE-2024-45337
- http://www.openwall.com/lists/oss-security/2024/12/11/2
- https://security.netapp.com/advisory/ntap-20250131-0007
- https://github.com/advisories/GHSA-v778-237x-gjrc
- https://ubuntu.com/security/notices/USN-7839-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7839-1 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2024-45337 Third Party Advisory
- https://go-review.googlesource.com/c/crypto/+/635315/ Third Party Advisory
- https://ubuntu.com/security/CVE-2024-45337 Third Party Advisory
- https://go.dev/cl/635315
- https://go.dev/issue/70779
- https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ
- https://pkg.go.dev/vuln/GO-2024-3321
- https://security.netapp.com/advisory/ntap-20250131-0007/
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-285Improper Authorization
Timeline
Published29 Sep 2026
Updated7 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta