CVE-2025-26465

Katalog CVE

CVSS 6.8 · Medium EPSS 7,7%

Kerentanan Detection of Error Condition Without Action pada openbsd openssh, netapp active iq unified manager +4 lainnya. Skor CVSS 3.1 6.8 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.

Rincian

Terbit di NVD

18 Februari 2025

Terakhir diubah

2 September 2026

Status NVD

Modified

CVSS 3.1

6.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-390: Detection of Error Condition Without Action

EPSS (30 hari)

7,7% peluang dieksploitasi; lebih tinggi dari 94,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/008_ssh.patch.sig patch
• https://www.vicarius.io/vsociety/posts/cve-2025-26465-mitigate-vulnerable-openssh mitigasi · advisory pihak ketiga
• https://access.redhat.com/security/cve/CVE-2025-26465 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2344780 issue tracking · advisory pihak ketiga
• https://seclists.org/oss-sec/2025/q1/144 mailing list · advisory pihak ketiga
• https://blog.qualys.com/vulnerabilities-threat-research/2025/02/18/qualys-tru-discovers-two-vulnerabilities-in... advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2025/02/msg00020.html advisory pihak ketiga
• https://lists.mindrot.org/pipermail/openssh-unix-announce/2025-February/000161.html advisory pihak ketiga
• https://security-tracker.debian.org/tracker/CVE-2025-26465 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20250228-0003/ advisory pihak ketiga
• https://ubuntu.com/security/CVE-2025-26465 advisory pihak ketiga
• https://www.openwall.com/lists/oss-security/2025/02/18/1 mailing list · advisory pihak ketiga
• https://www.openwall.com/lists/oss-security/2025/02/18/4 mailing list · advisory pihak ketiga
• https://www.vicarius.io/vsociety/posts/cve-2025-26465-detect-vulnerable-openssh advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2025:16823
• https://access.redhat.com/errata/RHSA-2025:3837
• https://access.redhat.com/errata/RHSA-2025:6993
• https://access.redhat.com/errata/RHSA-2025:8385
• https://access.redhat.com/solutions/7109879
• http://seclists.org/fulldisclosure/2025/Feb/18
• http://seclists.org/fulldisclosure/2025/May/7
• http://seclists.org/fulldisclosure/2025/May/8
• https://bugzilla.suse.com/show_bug.cgi?id=1237040 issue tracking
• https://www.openssh.com/releasenotes.html#9.9p2 release notes
• https://www.theregister.com/2025/02/18/openssh_vulnerabilities_mitm_dos/ press/media coverage