curls code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms.
This prevents curl from detecting MITM attackers and more.
Weakness
The product performs a key exchange with an actor without verifying the identity of that actor.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Curl | Haxx | 7.69.0 (including) | 8.17.0 (excluding) |
| Red Hat Hardened Images | RedHat | curl-main-8.19.0-3.hum1 | * |
| Curl | Ubuntu | upstream | * |