CWE-322: Key Exchange without Entity Authentication
The product performs a key exchange with an actor without verifying the identity of that actor.
A kind of CWE-306 Missing Authentication for Critical Functionality.
From the CWE List. © The MITRE Corporation.
Newest
- No product listed Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts 9.1 Critical
-
rexDebian Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no 9.1 Critical - apache software foundation airflow sftp provider Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default 4.3 Medium
- apache software foundation airflow sftp provider, airflow ssh provider +1 more Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default 9.1 Critical
- ffmpeg FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol 6.0 Medium
- havelsan inc. liman render engine SSH Host Key Verification Bypass in HAVELSAN's Liman Render Engine 5.9 Medium
- erlang otp TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension 9.3 Critical
- amazon aws command line interface, aws aws-cli +1 more Disabled SSH host key verification in Amazon AWS CLI EMR helper commands 6.9 Medium
- apache apache-airflow-providers-git, apache software foundation airflow git provider +1 more Apache Airflow Git provider: Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key verification 8.1 High
- line corporation central dogma Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror) 8.8 High
- apache apache-airflow-providers-google, apache software foundation airflow google provider +1 more Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default) 8.1 High
-
goshs.de/goshsGo,goshs.de/goshs/v2Go +1 more goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request 7.4 High - anthropic claude desktop, anthropics claude-code +1 more Claude Desktop: SSH Host Key Verification Bypass Allows Man-in-the-Middle Attack on Remote Sessions 7.4 High
- zero motorcycles firmware Zero Motorcycles Firmware Key Exchange without Entity Authentication 5.9 Medium
- juniper apstra Apstra: SSH host key validation vulnerability for managed devices 7.0 High
- ultraviolet cocos ai, ultravioletrs cocos +1 more CoCoS attested TLS is vulnerable to relay attacks via extracted ephemeral TLS keys 7.5 High
- keylime, red hat enterprise linux 10, enterprise linux 10.0 extended update support +9 more +11 more Keylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls authentication 9.4 Critical
- tp-link archer ax53 firmware, tp-link systems inc. archer ax53 v1.0, archer be3600 v1 +1 more +3 more SSH Hostkey Misconfiguration Vulnerability in Archer Devices 7.0 High
- curl, siemens ruggedcom rst2428p +1 more missing SFTP host verification with wolfSSH 4.3 Medium
- sandboxie-plus sandboxie Sandboxie exposes encrypted sandbox key during password change 6.9 Medium
- cisco nexus dashboard, data center network manager +1 more Cisco Nexus Dashboard Fabric Controller SSH Host Key Vulnerability 8.7 High
- arista ng firewall, arista networks edge threat management +1 more Backup uploads to ETM subject to man-in-the-middle interception 8.3 High
- brocade fabric os, broadcom fabric operating system +1 more Brocade Fabric OS before 9.2.2 does not enforce strict host key checking 7.0 High
- checkmk Improper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and filesystem' 6.3 Medium
- red hat satellite 6.15 for rhel 8 Foreman: host ssh key not being checked in remote execution 6.8 Medium
- matrix-nio project matrix-nio When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarder 8.6 High
- matrix matrix-rust-sdk When matrix-rust-sdk recieves forwarded room keys, the reciever doesn't check if it requested the key from the forwarder 8.6 High
- matrix javascript sdk, matrix-org matrix-js-sdk +1 more Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification 8.6 High
- matrix-org matrix-ios-sdk, matrix software development kit +1 more Matrix iOS SDK vulnerable to impersonation via forwarded Megolm sessions 7.5 High
- matrix-org matrix-ios-sdk, matrix software development kit +1 more Matrix iOS SDK vulnerable ton Olm/Megolm protocol confusion 8.6 High
- matrix-org matrix-android-sdk2, matrix software development kit +1 more matrix-android-sdk2 vulnerable to Olm/Megolm protocol confusion 8.6 High
- matrix-org matrix-android-sdk2, matrix software development kit +1 more matrix-android-sdk2 vulnerable to impersonation via forwarded Megolm sessions 7.5 High
- matrix javascript sdk, matrix-org matrix-js-sdk +1 more Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion 8.6 High
- matrix javascript sdk, matrix-org matrix-js-sdk +1 more Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions 7.5 High
- jenkins git client, jenkins project git client plugin +1 more Jenkins Git client plugin 3.11.0 does not perform SSH host key verification 8.1 High
- eclipse californium, the eclipse foundation eclipse californium +1 more In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based ... 7.5 High