CVE-2014-2653

原文の説明

The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate.

影響を受けるソフトウェア

• OpenSSH = 6.3= 6.2= 6.5= 6.0≤ 6.6= 6.4 完全一致

詳細

公開日

2014-03-27

最終更新

2026-06-17

CVSS ベクター

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-20

参考資料

• cve.org/CVE-2014-2653
• nvd.nist.gov/vuln/detail/CVE-2014-2653
• advisories.mageia.org/MGASA-2014-0166.html
• aix.software.ibm.com/aix/efixes/security/openssh_advisory4.asc
• lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.html
• lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.html
• marc.info/?l=bugtraq&m=141576985122836&w=2
• openwall.com/lists/oss-security/2014/03/26/7
• rhn.redhat.com/errata/RHSA-2014-1552.html
• rhn.redhat.com/errata/RHSA-2015-0425.html
• secunia.com/advisories/59855
• www.debian.org/security/2014/dsa-2894
• www.mandriva.com/security/advisories?name=MDVSA-2014:068
• www.mandriva.com/security/advisories?name=MDVSA-2015:095