GitHub Advisoryadvisory · Go

GHSA-67fw-w8f2-88wp casdoor's use of`ssh.InsecureIgnoreHostKey()` disables host key verification

MEDIUM Published 2024-08-01 Modified 2024-08-16 Official page ↗
Aliases
CVE-2024-41264
Ecosystem
Go
Packages
github.com/casdoor/casdoor
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-295, CWE-297
Reviewed
2024-08-02

Affected packages

• Go github.com/casdoor/casdoor: >= 1.541.0, <= 1.636.0 (no fix yet)

Description

An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the `ssh.InsecureIgnoreHostKey()` method.

Related

Alias · CVE (1)

  • CVE-2024-41264 An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method. vulnerability

Weakness · CWE (3)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-295 Improper Certificate Validation weakness
  • CWE-297 Improper Validation of Certificate with Host Mismatch weakness

References