CVE-2025-26465

Published Feb 18, 2025

Last updated a month ago

OpenSSH

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-26465 is a vulnerability in the OpenSSH client that can allow a man-in-the-middle (MitM) attack when the `VerifyHostKeyDNS` option is enabled. This option allows the client to verify the server's identity against DNS records. Due to a logic error in how the server's identity is verified when memory allocation errors occur, an attacker can potentially bypass these checks and impersonate the intended server. This could lead to the theft of sensitive information, such as credentials. While the `VerifyHostKeyDNS` option is currently disabled by default, it was previously enabled by default in certain environments like FreeBSD between September 2013 and March 2023. Administrators are encouraged to review their configurations to ensure this option is not enabled unless specifically required. The vulnerability has existed since late 2014 and highlights the importance of regularly reviewing and updating security configurations.

Description: A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.
Source: secalert@redhat.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.8
Impact score: 5.2
Exploitability score: 1.6
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Severity: MEDIUM

Weaknesses

secalert@redhat.com: CWE-390

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AD9E4318-20E3-420F-8EF5-7C05C3386586",
            "versionEndIncluding": "9.8",
            "versionStartIncluding": "6.9"
          },
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:6.8:p1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "50836FA3-8116-4D58-B73E-B4830FB3A551"
          },
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:9.9:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E2B53BBB-6916-478C-A896-77C7F7E7D5DE"
          },
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:9.9:p1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F7A2B794-BA83-4A01-BD2E-541F18CB9E37"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5"
          },
          {
            "criteria": "cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A20333EE-4C13-426E-8B54-D78679D5DDB8"
          },
          {
            "criteria": "cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "932D137F-528B-4526-9A89-CD59FA1AB0FE"
          },
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
          },
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "46D69DCC-AE4D-4EA5-861C-D60951444C6C"
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]