Junglewise Threat Intelligence

CVE-2025-26465: OpenBSD OpenSSH MitM via VerifyHostKeyDNS error mishandling

CVE-2025-26465 · Severity: medium · CVSS 6.8 · Published 2025-02-18

Technologies: Red Hat Enterprise Linux, Debian Linux, OpenBSD Openssh. Vendors: Red Hat, Debian, OpenBSD.

Executive brief

A vulnerability exists in OpenSSH, a widely used tool for secure remote access to servers. When a specific DNS verification setting is enabled, a sophisticated attacker could potentially intercept and manipulate the connection between a user and a server. This could allow the attacker to impersonate a legitimate server to steal sensitive information or credentials, though the attack is difficult to perform as it requires exhausting the target's system memory first.

Technical details

A vulnerability (CWE-390) exists in OpenSSH when the 'VerifyHostKeyDNS' option is enabled. The issue stems from the mishandling of error codes during host key verification via DNS. A remote attacker can perform a machine-in-the-middle (MitM) attack by impersonating a legitimate server. To successfully exploit this, the attacker must first trigger a memory exhaustion condition on the client to influence the error handling path. This high complexity requirement mitigates the risk. Patches have been released by OpenBSD (008_ssh.patch) and various Linux distributions including Red Hat and Debian.

Affected products

  • OpenBSD OpenSSH 6.9 through 9.8, 9.9, 9.9p1
  • Red Hat Enterprise Linux 8, 9.4
  • Debian Debian Linux 11.0, 12.0

Timeline

  • 2025-02-18: disclosed: Vulnerability disclosed by Qualys TRU
  • 2025-02-18: advisory
  • 2025-02-18: patched: OpenBSD released patch 008_ssh.patch

References

Related threats