0.004 2026-09-20T18:38:02Z
[SECURITY: connect() now verifies the server host key against known_hosts (CWE-322, reported privately via CPANSec). Previously strict_hostkeycheck was passed to libssh but ssh_session_is_known_server() was never consulted, so any server -- including a man-in-the-middle -- was accepted silently. With the default strict_hostkeycheck => 1, connect() now returns 0 with error() naming the problem when the host key is unknown, changed, of a different type, or known_hosts cannot be read; the session is disconnected and stays spent. strict_hostkeycheck => 0 disables the check entirely, as documented. Users who relied on the default and never populated known_hosts must add the host key (e.g. via ssh-keyscan) or set strict_hostkeycheck => 0 explicitly]
SHA256 hash of CPAN release
fedb4261bc0bbda574ba66f4cc86f45e56e7370d01e4a2739fb766eeaf799c8d *Net-LibSSH-0.004.tar.gz
