by Kastro CVE-2026-42508
golang.org/x/crypto golang.org/x/crypto/ssh/knownhosts — Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
Description · from the CVE record
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.
Affected
ProductAffectedFixed inSource
golang.org/x/crypto/ssh/knownhosts< 0.52.00.52.0CNA
Red Hat Enterprise Linux 10see advisory7:5.8.2-4.el10_2redhat-SADP
Red Hat Enterprise Linux 8see advisory8100020260701102925.afee755dredhat-SADP
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportsee advisory8060020260803064027.ad008a3aredhat-SADP
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-Onsee advisory8060020260803064027.ad008a3aredhat-SADP
Red Hat Enterprise Linux 8.8 Telecommunications Update Servicesee advisory8080020260721142025.63b34585redhat-SADP
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionssee advisory8080020260721142025.63b34585redhat-SADP
Red Hat Enterprise Linux 9see advisory6:5.8.2-4.el9_8redhat-SADP
RHEM 1.0 for RHEL 9see advisory0:1.0.3-1.el9emredhat-SADP
RHEM 1.1 for RHEL 10see advisory0:1.1.3-1.el10emredhat-SADP
RHEM 1.1 for RHEL 9see advisory0:1.1.3-1.el9emredhat-SADP
Cluster Observability Operator 1.5.0see advisory1787593637redhat-SADP
Scores by source
CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
redhat-SADP (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total