2413308 – (CVE-2025-10966) CVE-2025-10966 curl: Curl missing SFTP host verification with wolfSSH backend

Bug 2413308 (CVE-2025-10966) - CVE-2025-10966 curl: Curl missing SFTP host verification with wolfSSH backend

Summary: CVE-2025-10966 curl: Curl missing SFTP host verification with wolfSSH backend

Keywords:
Status:	NEW
Alias:	CVE-2025-10966
Product:	Security Response
Classification:	Other
Component:	vulnerability
Sub Component:
Version:	unspecified
Hardware:	All
OS:	Linux
Priority:	medium
Severity:	medium
Target Milestone:	---
Assignee:	Product Security DevOps Team
QA Contact:
Docs Contact:
URL:
Whiteboard:
Depends On:	2413428 2413430 2413431 2413433 2413434 2413427 2413429 2413432
Blocks:
TreeView+	depends on / blocked

Reported:	2025-11-07 08:01 UTC by OSIDB Bzimport
Modified:	2025-11-07 19:17 UTC (History)
CC List:	12 users (show)
Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments	(Terms of Use)

Description OSIDB Bzimport 2025-11-07 08:01:15 UTC

curl's code for managing SSH connections when SFTP was done using the wolfSSH
powered backend was flawed and missed host verification mechanisms.

This prevents curl from detecting MITM attackers and more.

Note You need to log in before you can comment on or make changes to this bug.