CVE-2018-6517 Improper Certificate Validation in chloride
Chloride library automatically added unknown host fingerprints to known_hosts, bypassing SSH host verification and enabling potential man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-6517?
CVE-2018-6517 is a high-severity vulnerability in Puppet Chloride, published on 17 Mar 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints for previously unknown hosts getting added to the user's known_hosts file without confirmation. In version 0.3.0 this is updated so that the user's known_hosts file is not updated by chloride.
Weakness: CWE-295
Which versions are affected by CVE-2018-6517?
2 open source packages ship an affected version, including chloride. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
chloride RubyGems | All versions | 0.3.0 |
chloride RubyGems | All versions | 0.3.0 |
Products include Puppet Chloride.
How do I fix CVE-2018-6517?
Upgrade chloride to 0.3.0 or later.
Is CVE-2018-6517 being exploited?
There is no known exploitation of CVE-2018-6517 in the wild and no public exploit code.
Sources
Also known as GHSA-573x-jhqh-jg36.