What is GHSA-67fw-w8f2-88wp?

GHSA-67fw-w8f2-88wp is a security advisory published by GitHub Security Advisories with Medium severity. casdoor's use of`ssh.InsecureIgnoreHostKey()` disables host key verification

Which CVE IDs does GHSA-67fw-w8f2-88wp cover?

GHSA-67fw-w8f2-88wp covers the following CVE IDs: CVE-2024-41264. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-67fw-w8f2-88wp?

GHSA-67fw-w8f2-88wp has a CVSS v3 base score of 3.7, published by GitHub Security Advisories.

Which products are affected by GHSA-67fw-w8f2-88wp?

GHSA-67fw-w8f2-88wp affects 1 product, including: go/github.com/casdoor/casdoor:\u003e= 1.541.0, \u003c= 1.636.0.

GHSA-67fw-w8f2-88wpMediumCVSS 3.7

casdoor's use of`ssh.InsecureIgnoreHostKey()` disables host key verification

Vendor

GitHub Security Advisories

Published

August 1, 2024

Last Modified

August 16, 2024

🔗 CVE IDs covered (1)

CVE-2024-41264 →

📋 Description

An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method.

🎯 Affected products1

go/github.com/casdoor/casdoor:>= 1.541.0, <= 1.636.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2024-41264
https://gist.github.com/nyxfqq/33ceaccbc9b05d439a944c2b55fa1c0f
https://github.com/casdoor/casdoor/blob/v1.636.0/object/viaSSHDialer.go
https://pkg.go.dev/vuln/GO-2024-3026
https://github.com/advisories/GHSA-67fw-w8f2-88wp