Описание
Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.
A flaw was found in Dulwich. The contrib/paramiko_vendor.py component is missing Secure Shell (SSH) host key verification. This vulnerability allows a remote attacker to impersonate a legitimate Git server. By doing so, the attacker could potentially intercept sensitive information or execute arbitrary code on the client system during a connection.
Отчет
This is an Important flaw where Dulwich's paramiko_vendor.py component lacks SSH host key verification. This allows a remote attacker to impersonate a Git server, potentially leading to sensitive data interception or arbitrary code execution on client systems. Exploitation requires user interaction, specifically connecting to a malicious Git server.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/controller-rhel9 | Under investigation | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/eda-controller-rhel9 | Under investigation | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/lightspeed-chatbot-rhel9 | Under investigation | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-27/controller-rhel9 | Under investigation | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-27/eda-controller-rhel9 | Under investigation | ||
| Red Hat Enterprise Linux 7 | resource-agents | Under investigation | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-kserve-agent-rhel9 | Affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-kserve-autogluon-server-rhel9 | Affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-kserve-controller-rhel9 | Affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-kserve-router-rhel9 | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
8.8 High
CVSS3
Связанные уязвимости
Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.
Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.
Dulwich through 1.1.0 was found to be missing SSH host key verificatio ...
EPSS
8.8 High
CVSS3