CVE-2025-26465

216.73.217.64

· Published 18/02/2025 19:15 · Modified 06/03/2025 17:20

Labels: CVE-2025-26465 2025-02-18 CVE-2025-26465 CWE-390 [email protected]

Essential information

Published: 18/02/2025 19:15
Modified: 06/03/2025 17:20
Author: —
Creator: —
CVSS: 6.8 MEDIUM (v3.1)
CISA KEV: No
CWE: —
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

CVSS metrics

Description

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.

NVD status

Status: Analyzed — CVE has been recently published to the CVE List and has been received by the NVD.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
openbsd / openssh	`cpe:2.3:a:openbsd:openssh::::::::`
openbsd / openssh	`cpe:2.3:a:openbsd:openssh:6.8:p1::::::`
openbsd / openssh	`cpe:2.3:a:openbsd:openssh:9.9:-::::::`
openbsd / openssh	`cpe:2.3:a:openbsd:openssh:9.9:p1::::::`
netapp / active iq unified manager	`cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::`
netapp / ontap	`cpe:2.3:a:netapp:ontap:9:::::::*`
redhat / openshift container platform	`cpe:2.3:a:redhat:openshift_container_platform:4.0:::::::*`
debian / debian linux	`cpe:2.3:o:debian:debian_linux:11.0:::::::*`
debian / debian linux	`cpe:2.3:o:debian:debian_linux:12.0:::::::*`
redhat / enterprise linux	`cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*`