CVE-2014-2653
published 2014-03-27CVE-2014-2653: The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by…
PriorityP337medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
EPSS
1.99%
78.1th percentile
The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openssh | < openssh 1:6.6p1-1 (bookworm) | openssh 1:6.6p1-1 (bookworm) |
| openbsd | openssh | <= 6.6 | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | >= 0 < 1:6.6p1-1 | 1:6.6p1-1 |
| openbsd | openssh | >= 0 < 1:6.6p1-1 | 1:6.6p1-1 |
| openbsd | openssh | >= 0 < 1:6.6p1-1 | 1:6.6p1-1 |
| openbsd | openssh | >= 0 < 1:6.6p1-1 | 1:6.6p1-1 |
| paloalto | pan-os | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
osv5.8MEDIUM
vendor_debian5.8LOW
vendor_redhat5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
PAN-SA-2020-0004 Informational: Third-party or open source vulnerabilities that do not affect PAN-OS
vendor_paloalto·2020-05-13·CVSS 7.5
CVE-2014-1692 [HIGH] PAN-SA-2020-0004 Informational: Third-party or open source vulnerabilities that do not affect PAN-OS
PAN-SA-2020-0004 Informational: Third-party or open source vulnerabilities that do not affect PAN-OS
Palo Alto Networks Product Security Assurance team has evaluated and determined that these third-party or open source vulnerabilities do not have a security impact on PAN-OS, or the scenarios required for successful
CVEs: CVE-2014-1692, CVE-2014-2532, CVE-2014-2653, CVE-2015-5352, CVE-2015-8325, CVE-2016-10009, CVE-2016-10010, CVE-2016-10708, CVE-2016-1908, CVE-2016-3115, CVE-2016-6515, CVE-2018-15473, CVE-2018-15919
Affected products: PAN-OS
BSD
FreeBSD-SA-15:16.openssh: OpenSSH multiple vulnerabilities
bsd_advisories·2015-07-28·CVSS 5.8
CVE-2014-2653 [MEDIUM] FreeBSD-SA-15:16.openssh: OpenSSH multiple vulnerabilities
FreeBSD-SA-15:16.openssh Security Advisory
The FreeBSD Project
Topic: OpenSSH multiple vulnerabilities
Category: contrib
Module: openssh
Announced: 2015-07-28, revised on 2015-07-30
Affects: All supported versions of FreeBSD.
Corrected: 2015-07-28 19:58:44 UTC (stable/10, 10.2-PRERELEASE)
2015-07-28 19:58:44 UTC (stable/10, 10.2-BETA2-p2)
2015-07-28 19:59:04 UTC (releng/10.2, 10.2-RC1-p1)
2015-07-28 19:59:11 UTC (releng/10.1, 10.1-RELEASE-p16)
2015-07-28 19:58:54 UTC (stable/9, 9.3-STABLE)
2015-07-28 19:59:22 UTC (releng/9.3, 9.3-RELEASE-p21)
2015-07-30 10:09:07 UTC (stable/8, 8.4-STABLE)
2015-07-30 10:09:31 UTC (releng/8.4, 8.4-RELEASE-p36)
CVE Name: CVE-2014-2653, CVE-2015-5600
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, s
Ubuntu
OpenSSH vulnerability
vendor_ubuntu·2014-04-07
CVE-2014-2653 OpenSSH vulnerability
Title: OpenSSH vulnerability
Summary: A malicious server could bypass OpenSSH SSHFP DNS record checking.
Matthew Vernon discovered that OpenSSH did not correctly check SSHFP DNS
records if a server presented an unacceptable host certificate. A malicious
server could use this issue to disable SSHFP checking.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
openssh: failure to check DNS SSHFP records in certain scenarios
vendor_redhat·2014-03-24·CVSS 5.8
CVE-2014-2653 [MEDIUM] CWE-287 openssh: failure to check DNS SSHFP records in certain scenarios
openssh: failure to check DNS SSHFP records in certain scenarios
The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate.
It was discovered that OpenSSH clients did not correctly verify DNS SSHFP records. A malicious server could use this flaw to force a connecting client to skip the DNS SSHFP record check and require the user to perform manual host verification of the DNS SSHFP record.
Statement: The Red Hat Security Response Team has rated this issue as having Moderate security impact. This issue is not planned to be fixed in Red Hat Enterprise Linux 5 as it is now in Production 3 Phase of the support and maintenance life cycle, https://acc
Debian
CVE-2014-2653: openssh - The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and ea...
vendor_debian·2014·CVSS 5.8
CVE-2014-2653 [MEDIUM] CVE-2014-2653: openssh - The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and ea...
The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate.
Scope: local
bookworm: resolved (fixed in 1:6.6p1-1)
bullseye: resolved (fixed in 1:6.6p1-1)
forky: resolved (fixed in 1:6.6p1-1)
sid: resolved (fixed in 1:6.6p1-1)
trixie: resolved (fixed in 1:6.6p1-1)
VulDB
OpenSSH up to 6.6 Fingerprint Record Check sshconnect.c verify_host_key HostCertificate input validation (Nessus ID 73401 / ID 185093)
vuldb·2026-05-09·CVSS 5.8
CVE-2014-2653 [MEDIUM] OpenSSH up to 6.6 Fingerprint Record Check sshconnect.c verify_host_key HostCertificate input validation (Nessus ID 73401 / ID 185093)
A vulnerability marked as critical has been reported in OpenSSH up to 6.6. The impacted element is the function verify_host_key of the file sshconnect.c of the component Fingerprint Record Check. Performing a manipulation as part of HostCertificate results in improper input validation.
This vulnerability was named CVE-2014-2653. The attack may be initiated remotely. There is no available exploit.
GHSA
GHSA-52r2-7jx8-c8gc: The verify_host_key function in sshconnect
ghsa_unreviewed·2022-05-17
CVE-2014-2653 [MEDIUM] CWE-20 GHSA-52r2-7jx8-c8gc: The verify_host_key function in sshconnect
The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate.
OSV
CVE-2014-2653: The verify_host_key function in sshconnect
osv·2014-03-27·CVSS 5.8
CVE-2014-2653 [MEDIUM] CVE-2014-2653: The verify_host_key function in sshconnect
The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-2653 openssh: failure to check DNS SSHFP records in certain scenarios
bugzilla·2014-03-27·CVSS 5.8
CVE-2014-2653 [MEDIUM] CVE-2014-2653 openssh: failure to check DNS SSHFP records in certain scenarios
CVE-2014-2653 openssh: failure to check DNS SSHFP records in certain scenarios
Matthew Vernon found that the OpenSSH client may fail to check DNS SSHFP records. When using DNS SSHFP records, if the server offers the client a certificate that the client does not accept, the client does not then verify the DNS SSHFP records. A host verification prompt is still displayed before connecting. A malicious server could possibly use this flaw to disable DNS SSHFP checking and trick a client into connecting to it, if the user accepts 'yes' at the host verification prompt.
Original report including a possible patch:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742513
Discussion:
Created openssh tracking bugs for this issue:
Affects: fedora-all [bug 1081341]
---
openssh-6.4p1-4.fc20 has b
Bugzilla
CVE-2014-2653 openssh: failure to check DNS SSHFP records in certain scenarios [fedora-all]
bugzilla·2014-03-27·CVSS 5.8
CVE-2014-2653 [MEDIUM] CVE-2014-2653 openssh: failure to check DNS SSHFP records in certain scenarios [fedora-all]
CVE-2014-2653 openssh: failure to check DNS SSHFP records in certain scenarios [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Please note:
http://advisories.mageia.org/MGASA-2014-0166.htmlhttp://aix.software.ibm.com/aix/efixes/security/openssh_advisory4.aschttp://lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.htmlhttp://marc.info/?l=bugtraq&m=141576985122836&w=2http://openwall.com/lists/oss-security/2014/03/26/7http://rhn.redhat.com/errata/RHSA-2014-1552.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0425.htmlhttp://secunia.com/advisories/59855http://www.debian.org/security/2014/dsa-2894http://www.mandriva.com/security/advisories?name=MDVSA-2014:068http://www.mandriva.com/security/advisories?name=MDVSA-2015:095http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.htmlhttp://www.securityfocus.com/bid/66459http://www.ubuntu.com/usn/USN-2164-1https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742513http://advisories.mageia.org/MGASA-2014-0166.htmlhttp://aix.software.ibm.com/aix/efixes/security/openssh_advisory4.aschttp://lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.htmlhttp://marc.info/?l=bugtraq&m=141576985122836&w=2http://openwall.com/lists/oss-security/2014/03/26/7http://rhn.redhat.com/errata/RHSA-2014-1552.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0425.htmlhttp://secunia.com/advisories/59855http://www.debian.org/security/2014/dsa-2894http://www.mandriva.com/security/advisories?name=MDVSA-2014:068http://www.mandriva.com/security/advisories?name=MDVSA-2015:095http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.htmlhttp://www.securityfocus.com/bid/66459http://www.ubuntu.com/usn/USN-2164-1https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742513
2014-03-27
Published