Description (CNA)
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Not supplied / Not supplied | affected 6.8p1 through 9.9p1 |
| Red Hat / Red Hat Enterprise Linux 8 | unaffected 0:8.0p1-26.el8_10 before * |
| Red Hat / Red Hat Enterprise Linux 8 | unaffected 0:8.0p1-26.el8_10 before * |
| Red Hat / Red Hat Enterprise Linux 9 | unaffected 0:8.7p1-45.el9 before * |
| Red Hat / Red Hat Enterprise Linux 9 | unaffected 0:8.7p1-45.el9 before * |
| Red Hat / Red Hat Enterprise Linux 9.4 Extended Update Support | unaffected 0:8.7p1-38.el9_4.5 before * |
| Red Hat / Red Hat Discovery 1.14 | unaffected 1.14.3-1748529279 before * |
| Red Hat / Red Hat Enterprise Linux 10 | unaffected |
| Red Hat / Red Hat Enterprise Linux 6 | unknown |
| Red Hat / Red Hat Enterprise Linux 7 | unknown |
| Red Hat / Red Hat OpenShift Container Platform 4 | affected |
CWE
CWE-390
References
- https://access.redhat.com/errata/RHSA-2025:16823
- https://access.redhat.com/errata/RHSA-2025:3837
- https://access.redhat.com/errata/RHSA-2025:6993
- https://access.redhat.com/errata/RHSA-2025:8385
- https://access.redhat.com/security/cve/CVE-2025-26465
- https://access.redhat.com/solutions/7109879
- https://bugzilla.redhat.com/show_bug.cgi?id=2344780
- https://seclists.org/oss-sec/2025/q1/144
ADP enrichment
No English description supplied.
- https://lists.debian.org/debian-lts-announce/2025/02/msg00020.html
- https://www.openwall.com/lists/oss-security/2025/02/18/1
- https://www.openwall.com/lists/oss-security/2025/02/18/4
- https://www.theregister.com/2025/02/18/openssh_vulnerabilities_mitm_dos/
- https://bugzilla.suse.com/show_bug.cgi?id=1237040
- https://security-tracker.debian.org/tracker/CVE-2025-26465
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/008_ssh.patch.sig
- https://ubuntu.com/security/CVE-2025-26465
- https://www.openssh.com/releasenotes.html#9.9p2
- https://blog.qualys.com/vulnerabilities-threat-research/2025/02/18/qualys-tru-discovers-two-vulnerabilities-in-openssh-cve-2025-26465-cve-2025-26466
- https://lists.mindrot.org/pipermail/openssh-unix-announce/2025-February/000161.html
- https://security.netapp.com/advisory/ntap-20250228-0003/
- https://www.vicarius.io/vsociety/posts/cve-2025-26465-detect-vulnerable-openssh
- https://www.vicarius.io/vsociety/posts/cve-2025-26465-mitigate-vulnerable-openssh
- http://seclists.org/fulldisclosure/2025/May/8
- http://seclists.org/fulldisclosure/2025/May/7
- http://seclists.org/fulldisclosure/2025/Feb/18
No English description supplied.
No English description supplied.