Threats tagged 'ghsa-xx8j-qhmg-cj8f'

Rex versions through 1.16.1 for Perl contain a vulnerability where the SSH host key verification is disabled (StrictHostKeyChecking=no) for remote rsync transfers. This allows an attacker who can intercept or redirect the connection to present a malicious SSH host key, causing the client to accept it without verification. Consequently, sensitive data such as passwords can be exposed, and files can be uploaded or downloaded to an attacker-controlled server.