Cpe:2.3:a:net::libssh_project:net::libssh:*:*:*:*:*:perl:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3anetlibssh_projectnetlibsshperl/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 01:36:30 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgNet::LibSSH: Improper host key verification (CVE-2026-94423)https://feed.craftedsignal.io/briefs/2026-10-net-libssh-mitm/Thu, 22 Oct 2026 01:36:30 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-net-libssh-mitm/The Net::LibSSH Perl module fails to verify host keys against known_hosts during connection establishment, enabling man-in-the-middle attacks.The Perl distribution Net::LibSSH contains a vulnerability (CVE-2026-94423) where the connect function fails to perform host key verification. This allows an attacker positioned in a man-in-the-middle capacity to intercept or spoof SSH traffic, as the client implicitly trusts any server it connects to. This affects all versions of Net::LibSSH prior to 0.004.

Impact

Successful exploitation allows for man-in-the-middle attacks, potentially leading to the interception of sensitive data, credentials, or the execution of malicious commands on the client system if the SSH session is subsequently used for administrative operations.

Recommendation

  • Update the Net::LibSSH Perl module to version 0.004 or later.
  • Audit applications utilizing Net::LibSSH to identify instances where SSH connections are established to untrusted or external endpoints.
  • Implement network-level controls to restrict SSH outbound access to known, verified server IP ranges.
]]>highadvisorysupply-chainvulnerabilityperlssh