VULNERABILITY INTELLIGENCE

CVE-2014-2653

CVSS score6.5 MEDIUM
EPSS probability1.99%
CISA KEVNot currently listed
Published2014-03-27
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Description

The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate.

Weakness classification

  • CWE-20: Improper Input Validation

Primary references