Known/Static SSH Host Key Used (TCP)

The remote host uses a default SSH host key that is shared among multiple installations. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD : ansible -- enable host key checking in paramiko connection type (a478421e-2059-11e5-a4a5-002590263bf5)

Ansible changelog reports : Host key checking is on by default. Disable it if you like by adding hostkeychecking=False in the default section of /etc/ansible/ansible.cfg or /ansible.cfg or by exporting ANSIBLEHOSTKEYCHECKING=False. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Cisco Ironport Security Appliance Default Host Key Vulnerability

The remote Cisco security appliance uses a default host key that is shared among all installations of the product. An unauthenticated, remote attacker with knowledge of the private key can impersonate other devices or perform a man-in-the-middle attack between this host and other virtual security...

Cisco Cloud Portal Default SSH HOST Key Man-in-the-Middle Attack Vulnerability

Cisco Cloud Portal is a cloud portal for data center services. Cisco Cloud Portal has a security vulnerability due to the system using a default host key for SSH communication. A remote attacker could modify the target system data through a man-in-the-middle attack...

CVE-2014-5341

The SFTP external storage driver filesexternal in ownCloud Server before 6.0.5 validates the RSA Host key after login, which allows remote attackers to obtain sensitive information by sniffing the network...

Design/Logic Flaw

The SFTP external storage driver filesexternal in ownCloud Server before 6.0.5 validates the RSA Host key after login, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2014-5341

The SFTP external storage driver filesexternal in ownCloud Server before 6.0.5 validates the RSA Host key after login, which allows remote attackers to obtain sensitive information by sniffing the network...

openssh security, bug fix, and enhancement update

5.3p1-104 - ignore SIGXFSZ in postauth monitor child 1133906 5.3p1-103 - don't try to generate DSA keys in the init script in FIPS mode 1118735 5.3p1-102 - ignore SIGPIPE in ssh-keyscan 1108836 5.3p1-101 - ssh-add: fix fatal exit when removing card 1042519 5.3p1-100 - fix race in backported...

Insufficient RSA Host Key validation in files_external (SFTP driver) - ownCloud

The SFTP external storage driver was verifying the RSA Host Key after logging in. This allows for a man-in-the-middle MITM attack even if the host key is already known and can be validated. Basically, at the point where the host key was validated, the secret has already been given away. It should...

Server: Insufficient RSA Host Key validation in files_external (SFTP driver)

The SFTP external storage driver was verifying the RSA Host Key after logging in. This allows for a man-in-the-middle MITM attack even if the host key is already known and can be validated. Basically, at the point where the host key was validated, the secret has already been given away. It should...

DEBIAN-CVE-2014-2653

The verifyhostkey function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate...

CVE-2014-2653

The verifyhostkey function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate...

SuperMicro Device Uses Default SSH Host Key

The SSH host key used by the remote host has not been changed from the default host key that is hardwired into the firmware. The private key corresponding to this host key is shared across all devices running the same firmware, meaning that the remote host's key certificate cannot be trusted...

Default configuration

The default configuration for salt-ssh in Salt aka SaltStack 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle MITM attack...

CVE-2013-4436

The default configuration for salt-ssh in Salt aka SaltStack 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle MITM attack...

PYSEC-2013-26

The default configuration for salt-ssh in Salt aka SaltStack 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle MITM attack...

CVE-2013-4436

Removed by vendor...

CVE-2013-4436

CVE-2013-4436 concerns SaltStack’s salt-ssh default configuration (Salt 0.17.0) that does not validate the SSH host key, enabling MITM-style impact. Multiple connected sources (GHSA-F22J-37JJ-CXW9, OSV, NVD variant) corroborate the MITM risk but do not provide exploit details. A remediation menti...

CVE-2013-4436

The default configuration for salt-ssh in Salt aka SaltStack 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle MITM attack...

FreeBSD : PuTTY -- Four security holes in versions before 0.63 (4b448a96-ff73-11e2-b28d-080027ef73ec)

Simon Tatham reports : This 0.63 release fixes multiple security holes in previous versions of PuTTY, which can allow an SSH-2 server to make PuTTY overrun or underrun buffers and crash. ... These vulnerabilities can be triggered before host key verification, which means that you are not even saf...