CVE-2025-15079: libssh global known_hosts override
When doing SSH-based transfers using either SCP or SFTP, and setting the knownhosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global knownhosts file.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15079?
CVE-2025-15079 has a medium severity level due to the potential for unauthorized access through SSH-based transfers.
How do I fix CVE-2025-15079?
To mitigate CVE-2025-15079, ensure that the known_hosts configuration is strictly enforced, and review your SSH settings to prevent usage of the global known_hosts file.
What software is affected by CVE-2025-15079?
CVE-2025-15079 primarily affects redhat/libcurl when performing SSH-based transfers.
What are the implications of CVE-2025-15079?
The implications of CVE-2025-15079 include the risk of connecting to untrusted hosts, leading to potential data interception or manipulation.
Is there any workaround for CVE-2025-15079?
As a workaround for CVE-2025-15079, users can manually specify known hosts and avoid reliance on the global known_hosts file.