Bug 2350816 - CVE-2025-22869 docker-compose: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh [fedora-41]
Summary: CVE-2025-22869 docker-compose: Denial of Service in the Key Exchange of golan...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: docker-compose
Version: 41
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
Assignee: Brad Smith
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: {"flaws": ["9f978159-dda3-482c-997c-3...
Depends On:
Blocks: CVE-2025-22869
TreeView+ depends on / blocked
 
Reported: 2025-03-08 01:16 UTC by Anten Skrabec
Modified: 2025-03-10 14:28 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2025-03-10 14:28:22 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Anten Skrabec 2025-03-08 01:16:32 UTC
More information about this security flaw is available in the following bug:

https://bugzilla.redhat.com/show_bug.cgi?id=2348367

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Comment 1 Brad Smith 2025-03-08 17:09:25 UTC
Using 

rpm -qpl --provides docker-compose-2.30.3-1.fc41.x86_64.rpm  | less 

demonstrates that the golang.org/x/crypto/ssh package is not present in docker-compose for F41.

output excerpt below:

bundled(golang(go.uber.org/mock)) = 0.5.0
bundled(golang(golang.org/x/crypto)) = 0.26.0
bundled(golang(golang.org/x/exp)) = 9b4947d
bundled(golang(golang.org/x/net)) = 0.28.0
bundled(golang(golang.org/x/oauth2)) = 0.22.0
bundled(golang(golang.org/x/sync)) = 0.8.0
bundled(golang(golang.org/x/sys)) = 0.26.0
bundled(golang(golang.org/x/term)) = 0.23.0
bundled(golang(golang.org/x/text)) = 0.17.0
bundled(golang(golang.org/x/time)) = 0.6.0
bundled(golang(google.golang.org/genproto)) = ef43131

Comment 2 Brad Smith 2025-03-08 18:42:38 UTC
My mistake reading the list of provides. x/crypto will, potentially, also include x/crypto/ssh. Reopening.

Comment 3 Brad Smith 2025-03-10 14:28:22 UTC
Docker-compose does not function as an ssh client or ssh server.


Note You need to log in before you can comment on or make changes to this bug.