Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS04dnE0LThoZnAtMjl4aM4ABDgF

Eugeny Tabby Sends Password Despite Host Key Verification Failure

An issue in Eugeny Tabby 1.0.213 allows a remote attacker to obtain sensitive information via the server and sends the SSH username and password even when the host key verification fails.

Permalink: https://github.com/advisories/GHSA-8vq4-8hfp-29xh
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04dnE0LThoZnAtMjl4aM4ABDgF
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 1 day ago
Updated: 32 minutes ago

EPSS Percentage: 0.00043
EPSS Percentile: 0.1136

Identifiers: GHSA-8vq4-8hfp-29xh, CVE-2024-48460
References:

• https://nvd.nist.gov/vuln/detail/CVE-2024-48460
• https://github.com/Eugeny/tabby/issues/9955
• https://github.com/Eugeny/tabby/commit/1c077147acd0a6ec9f8ee80d83a3e9688fbb9444
• https://github.com/advisories/GHSA-8vq4-8hfp-29xh

Repository: https://github.com/Eugeny/tabby
Blast Radius: 0.0

Affected Packages