SUSE-SU-2025:4445-1 Security update 5.1.1.1 for Multi-Linux Manager Salt Bundle

This update fixes the following issues: venv-salt-minion: - Security issues fixed: - CVE-2025-62349: Added minimumauthversion to enforce security bsc1254257 - CVE-2025-62348: Fixed Junos module yaml loader bsc1254256 - Backport security fixes for vendored tornado BDSA-2024-3438 BDSA-2024-3439...

CVE-2025-34207

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to 22.0.1049 and Application prior to 20.0.2786 VA and SaaS deployments configure the SSH client within Docker instances with the following options: UserKnownHostsFile=/dev/null, StrictHostKeyChecking=no, and ForwardAgent yes. These...

CVE-2025-34207 Vasion Print (formerly PrinterLogic) Insecure SSH Client Configuration

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to 22.0.1049 and Application prior to 20.0.2786 VA and SaaS deployments configure the SSH client within Docker instances with the following options: UserKnownHostsFile=/dev/null, StrictHostKeyChecking=no, and ForwardAgent yes. These...

Do Not Preset known_hosts for the SSH Service

knownhosts stores the public keys of the computers that the host has accessed. After a user successfully logs in to another computer, the public key information is automatically saved in $HOME/.ssh/knownhosts. When the same computer is accessed next time, its public key is verified. If the...

curl: CVE-2025-10966: missing SFTP host verification with wolfSSH

Summary: When curl is built with the wolfSSH backend, the SSH/SFTP implementation in lib/vssh/wolfssh.c performs no server host key verification and exposes no host identity options in the curl tool. I verified this locally by building curl with wolfSSH binary reports wolfssh/1.4.20, observing th...

Do Not Preset known_hosts for the SSH Service

knownhosts stores the public keys of the computers that the host has accessed. After a user successfully logs in to another computer, the public key information is automatically saved in $HOME/.ssh/knownhosts. When the same computer is accessed next time, its public key is verified. If the...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation during SSH connections if the certificate isn’t set in the knownhosts file. An attacker can intercept and manipulate data by positioning themselves between the client and server, effectively conducting a...

curl: curl allows SSH connection even if host is not in known_hosts

Summary: Curl does not fail if the SSH host identity cannot be verified due to the host not being included in the .ssh/knownhosts file. This makes using curl to login into an previously unknown ssh host system vulnerable to meddler in the middle attacks. When using key based authentication it wil...

PT-2026-1659

Name of the Vulnerable Software and Affected Versions libssh affected versions not specified Description The libssh software contains a flaw related to a global knownhost override. This issue could potentially allow an attacker to bypass host key verification, potentially leading to...

SUSE-SU-2023:3145-1 Security update for salt

This update for salt fixes the following issues: Security fixes: - CVE-2023-28370: Fix an open redirect vulnerability in 'StaticFileHandler' under certain configurations bsc1211741 Bug fixes: - Prevent error loading 'knownhosts' when '$HOME' is not set bsc1210994 - Fix ModuleNotFoundError and oth...

SUSE-SU-2023:3143-1 Security update for salt

This update for salt fixes the following issues: Security fixes: - CVE-2023-28370: Fix an open redirect vulnerability in 'StaticFileHandler' under certain configurations bsc1211741 Bug fixes: - Prevent error loading 'knownhosts' when '$HOME' is not set bsc1210994 - Fix ModuleNotFoundError and oth...

SUSE-SU-2023:3139-1 Security update for salt

This update for salt fixes the following issues: Security fixes: - CVE-2023-28370: Fix an open redirect vulnerability in 'StaticFileHandler' under certain configurations bsc1211741 Bug fixes: - Prevent error loading 'knownhosts' when '$HOME' is not set bsc1210994 - Fix ModuleNotFoundError and oth...

SUSE-EL-9-CLIENT-TOOLS-2023-3137 Security update for SUSE Manager Salt Bundle

This update fixes the following issues: venv-salt-minion: - CVE-2023-28370: Tornado: Fix an open redirect issue in the static file handler bsc1211741 - Prevent pygit2.GitError: error loading knownhosts when $HOME is not set bsc1210994 - Fix ModuleNotFoundError and other issues raised by...

PT-2020-16345 · Project Jupyter +3 · Jupyter Notebook +3

Name of the Vulnerable Software and Affected Versions: Jupyter Notebook versions prior to 6.1.5 Description: The issue is an open redirect vulnerability, where a maliciously crafted link to a notebook server could redirect the browser to a different website. All notebook servers are technically...

Security update for libssh2_org (moderate)

openSUSE Security Update: Security update for libssh2org Announcement ID: openSUSE-SU-2019:1075-1 Rating: moderate References: 1091236 1128471 1128472 1128474 1128476 1128480 1128481 1128490 1128492 1128493 Cross-References: CVE-2019-3855 CVE-2019-3856 CVE-2019-3857 CVE-2019-3858 CVE-2019-3859...

ssh-hostkey NSE Script

Shows SSH hostkeys. Shows the target SSH server's key fingerprint and with high enough verbosity level the public key itself. It records the discovered host keys in nmap.registry for use by other scripts. Output can be controlled with the sshhostkey script argument. You may also compare the...

Low: openssh security and bug fix update

3.9p1-8.RHEL4.20 - CVE-2006-5794 properly detect failed key verify in monitor 214640 3.9p1-8.RHEL4.19 - add support for hashed knownhosts file 162681 3.9p1-8.RHEL4.18 - fixed client behaviour when remote program generates large output 184357 - don't report duplicate syslog messages, use correct...

openssh vulnerable to known_hosts address harvesting

SSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames, IP addresses, and keys in plaintext in the knownhosts file, which makes it easier for an attacker that has compromised an SSH user's account to generate a list of additional targets that are more likel...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials. SSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames, IP addresses, and keys in plaintext in the knownhosts file, which makes it easier for an attacker that...

PT-2005-3554 · Openssh +2 · Openssh +2

Name of the Vulnerable Software and Affected Versions: OpenSSH versions prior to 4.0 Description: The issue allows an attacker that has compromised an SSH user's account to more easily generate a list of additional targets that are more likely to have the same password or key. This is because...