The Dulwich library up to version 1.1.0 contains a vulnerability where SSH host key verification is missing in the contrib/paramiko_vendor.py file. This absence of verification can allow an attacker to intercept or manipulate SSH connections by impersonating the server, undermining the authenticity of the SSH host. The vulnerability is categorized under CWE-295 (Improper Certificate Validation) and has a CVSS 3.1 base score of 5.3, indicating a medium severity level. There is no vendor advisory or patch information available at this time, so the remediation status is unknown.

The lack of SSH host key verification can lead to man-in-the-middle attacks, allowing an attacker to intercept or alter data transmitted over SSH connections. The confidentiality of the data may be compromised, but integrity and availability are not directly affected according to the CVSS vector. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider avoiding use of the vulnerable SSH functionality in Dulwich or implement external SSH host key verification mechanisms as a temporary mitigation.