Threats tagged 'ghsa-5q49-7p5p-mjwf'

Net::LibSSH versions before 0.004 for Perl do not verify the server's host key during connection, allowing authentication to an unverified server. This occurs because the connect function reports success once ssh_connect returns SSH_OK without checking the host key against known_hosts. As a result, authentication and session operations occur on a session with an unverified peer, enabling an attacker who can redirect the connection to capture passwords and manipulate commands and data.