Every CVE Search/ Get API key

CVE-2014-2653

The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows...

5.8 MediumFix available

The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate.

Exploit likelihood

1.99%Down 0.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

CVE List 6.5

The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate.

Record
CVE-2014-2653
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-20
Updated
2026-11-02
EUVDEUVD-2014-2685 6.5

The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate.

Record
EUVD-2014-2685
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-52r2-7jx8-c8gc 6.5

The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows...

The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate.

Record
GHSA-52r2-7jx8-c8gc
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-20
Updated
2026-11-02
NVD 6.5

The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate.

Record
CVE-2014-2653
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Weakness
CWE-20
Updated
2026-11-02
OSVDEBIAN-CVE-2014-2653 6.5

The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate.

Record
DEBIAN-CVE-2014-2653
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSV No score

The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate.

Record
CVE-2014-2653
Updated
2026-11-02
OSVMGASA-2014-0166 No score

Updated openssh packages fix CVE-2014-2653

Updated openssh packages fix security vulnerability:

Matthew Vernon reported that if a SSH server offers a HostCertificate that the ssh client doesn't accept, then the client doesn't check the DNS for SSHFP records. As a consequence a malicious server can disable SSHFP-checking by presenting a certificate (CVE-2014-2653).

Record
MGASA-2014-0166
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openssh
Debian:12
 before 1:6.6p1-1
1:6.6p1-1
openssh
Debian:13
 before 1:6.6p1-1
1:6.6p1-1
openssh
Debian:14
 before 1:6.6p1-1
1:6.6p1-1
openssh
Debian:6.0
From an advisory covering 2 CVEs
 before 1:5.5p1-6+squeeze5, plus listed versions
1:5.5p1-61:5.5p1-6+squeeze11:5.5p1-6+squeeze21:5.5p1-6+squeeze31:5.5p1-6+squeeze4
1:5.5p1-6+squeeze5
openssh
Debian:7
From an advisory covering 2 CVEs
 before 1:6.0p1-4+deb7u1, plus listed versions
1:6.0p1-4
1:6.0p1-4+deb7u1
openssh
Mageia:3
 before 6.1p1-4.3.mga3
6.1p1-4.3.mga3
openssh
Mageia:4
 before 6.2p2-3.2.mga4
6.2p2-3.2.mga4
openssh-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:5.3p1-104.el6
0:5.3p1-104.el6
openssh-ldap
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:5.3p1-104.el6
0:5.3p1-104.el6
pam_ssh_agent_auth
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:0.9.3-104.el6
0:0.9.3-104.el6
Show 61 moreShow less
Affected packages
PackageAffectedFixed
openssh
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:5.3p1-104.el6
0:5.3p1-104.el6
openssh-askpass
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:5.3p1-104.el6
0:5.3p1-104.el6
openssh-clients
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:5.3p1-104.el6
0:5.3p1-104.el6
openssh-server
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:5.3p1-104.el6
0:5.3p1-104.el6
openssh-askpass
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:5.3p1-104.el6
0:5.3p1-104.el6
openssh-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:5.3p1-104.el6
0:5.3p1-104.el6
openssh-ldap
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:5.3p1-104.el6
0:5.3p1-104.el6
pam_ssh_agent_auth
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:0.9.3-104.el6
0:0.9.3-104.el6
openssh
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:5.3p1-104.el6
0:5.3p1-104.el6
openssh-clients
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:5.3p1-104.el6
0:5.3p1-104.el6
openssh-server
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:5.3p1-104.el6
0:5.3p1-104.el6
openssh-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:5.3p1-104.el6
0:5.3p1-104.el6
openssh-ldap
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:5.3p1-104.el6
0:5.3p1-104.el6
pam_ssh_agent_auth
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:0.9.3-104.el6
0:0.9.3-104.el6
openssh
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:5.3p1-104.el6
0:5.3p1-104.el6
openssh-askpass
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:5.3p1-104.el6
0:5.3p1-104.el6
openssh-clients
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:5.3p1-104.el6
0:5.3p1-104.el6
openssh-server
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:5.3p1-104.el6
0:5.3p1-104.el6
openssh-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:5.3p1-104.el6
0:5.3p1-104.el6
openssh-ldap
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:5.3p1-104.el6
0:5.3p1-104.el6
pam_ssh_agent_auth
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:0.9.3-104.el6
0:0.9.3-104.el6
openssh
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:5.3p1-104.el6
0:5.3p1-104.el6
openssh-askpass
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:5.3p1-104.el6
0:5.3p1-104.el6
openssh-clients
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:5.3p1-104.el6
0:5.3p1-104.el6
openssh-server
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:5.3p1-104.el6
0:5.3p1-104.el6
openssh-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-ldap
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-server-sysvinit
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
pam_ssh_agent_auth
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:0.9.3-9.11.el7
0:0.9.3-9.11.el7
openssh
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-askpass
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-clients
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-keycat
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-server
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-askpass
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-debuginfo
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-ldap
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-server-sysvinit
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
pam_ssh_agent_auth
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:0.9.3-9.11.el7
0:0.9.3-9.11.el7
openssh
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-clients
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-keycat
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-server
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-ldap
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-server-sysvinit
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
pam_ssh_agent_auth
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:0.9.3-9.11.el7
0:0.9.3-9.11.el7
openssh
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-askpass
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-clients
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-keycat
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-server
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-ldap
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-server-sysvinit
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
pam_ssh_agent_auth
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:0.9.3-9.11.el7
0:0.9.3-9.11.el7
openssh
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-askpass
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-clients
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-keycat
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-server
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-2653 is a medium vulnerability (CVSS 5.8) in Openbsd Openssh, published March 27, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.99%, the 80th percentile. Fixed in openssh 1:6.6p1-1.

References

Show 50 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open