Bug 2344780 (CVE-2025-26465)
| Summary: | CVE-2025-26465 openssh: Machine-in-the-middle attack if VerifyHostKeyDNS is enabled | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | adudiak, duclee, klaas, kshier, mhhall3, omaciel, ralph, sasakshi, sdodson, security-response-team, stcannon, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Deadline: | 2025-02-17 | ||
|
Description
OSIDB Bzimport
2025-02-10 22:04:10 UTC
Making it Public as https://seclists.org/oss-sec/2025/q1/144 I am reading that correctly on https://access.redhat.com/security/cve/CVE-2025-26465 -- there is no fix planned for rhel8 because it's a non-default config+moderate rating? Regarding the CVE link mentioned below, the OpenSSH client must have the VerifyHostKeyDNS option enabled, which is disabled by default in Red Hat Enterprise Linux (RHEL). https://access.redhat.com/security/cve/CVE-2025-26465#cve-affected-packages Products / Services Components State Errata Release Date ``` Red Hat Enterprise Linux 9 openssh Affected Red Hat OpenShift Container Platform 4 rhcos Fix deferred If ` VerifyHostKeyDNS` option is disabled in RHEL 9, then why it's `affected` state. Is there any timeline to fix this in RHCOS? Customer is looking for update on my previous comment. Kindly assist. Thanks! This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2025:3837 https://access.redhat.com/errata/RHSA-2025:3837 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:6993 https://access.redhat.com/errata/RHSA-2025:6993 |