REDHAT-BUG-2496758: High severity libcurl vulnerability
When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPTSSHKEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the knownhosts file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications built on libcurl are affected when they perform SCP:// or SFTP:// transfers and use the CURLOPT_SSH_KEYFUNCTION callback. The issue concerns validation of server host keys recorded in known_hosts.
What would an attacker need to exploit this?
An attacker would need to present an untrusted server host key whose type differs from the key type already recorded for that host in known_hosts. Under the affected callback handling, the connection may succeed without a warning, enabling a potential man-in-the-middle attack.