Summary
Jakub Ciolek discovered that the Go Cryptography module included in
Google Guest Agent did not validate GSSAPI authentication requests during
SSH operations. An attacker could possibly use this issue to cause a
denial of service.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | google-guest-agent | 20250116.00-0ubuntu1~22.04.2 |
| Ubuntu · 24.04 LTS 24.04:LTS | google-guest-agent | 20250116.00-0ubuntu1~24.04.3 |
| Ubuntu · 25.10 | google-guest-agent | 20250506.01-0ubuntu1.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | google-guest-agent | 20240716.00-0ubuntu1~16.04.0+esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | google-guest-agent | 20241011.01-0ubuntu1~18.04.0+esm2 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | google-guest-agent | 20250116.00-0ubuntu1~20.04.0+esm2 |
References
-
report
https://ubuntu.com/security/CVE-2025-58181