CVE-2025-26465 (Medium) detected in multiple libraries

[mend-bolt-for-github]

CVE-2025-26465 - Medium Severity Vulnerability

Vulnerable Libraries - src3.1.5, src3.1.5, src3.1.5

Vulnerability Details

In OpenSSH versions 6.8p1 to 9.9p1, a logic error in ssh(1) allowed an on-path attacker to impersonate any server when the VerifyHostKeyDNS option is enabled. This option is disabled by default.

Publish Date: 2025-02-18

URL: CVE-2025-26465

CVSS 3 Score Details (6.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.openssh.com/txt/release-9.9p2

Release Date: 2025-02-17

Fix Resolution: https://github.com/openssh/openssh-portable.git - V_9_9_P2

---

Step up your Open Source Security Game with Mend here