Improper Certificate Validation in chloride
High severity
GitHub Reviewed
Published
Mar 25, 2019
to the GitHub Advisory Database
•
Updated Nov 4, 2023
Description
Published by the National Vulnerability Database
Mar 21, 2019
Published to the GitHub Advisory Database
Mar 25, 2019
Reviewed
Jun 16, 2020
Last updated
Nov 4, 2023
Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints for previously unknown hosts getting added to the user's known_hosts file without confirmation. In version 0.3.0 this is updated so that the user's known_hosts file is not updated by chloride.
References