GHSA-573x-jhqh-jg36
Suggest an improvement- Source
- https://github.com/advisories/GHSA-573x-jhqh-jg36
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/03/GHSA-573x-jhqh-jg36/GHSA-573x-jhqh-jg36.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-573x-jhqh-jg36
- Aliases
- Published
- 2019-03-25T16:16:27Z
- Modified
- 2024-02-16T08:22:49.073607Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- Improper Certificate Validation in chloride
- Details
-
Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints for previously unknown hosts getting added to the user's knownhosts file without confirmation. In version 0.3.0 this is updated so that the user's knownhosts file is not updated by chloride.
- Database specific
{ "nvd_published_at": "2019-03-21T16:00:56Z", "cwe_ids": [ "CWE-295" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2020-06-16T21:00:14Z" }- References
Affected packages
RubyGems / chloride
Package
- Name
- chloride
- Purl
- pkg:gem/chloride