What happened
When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file.
Affected versions
curl: 7.58.0 through before 8.14.2 (semver); 8.15.0 through before 8.16.1 (semver); 8.17.0 through before 8.18.0 (semver); c92d2e14cfb0db662f958effd2ac86f995cf1b5a through before adca486c125d9a6d9565b9607a19dce803a8b479 (git); 8.17.0; 8.16.0; 8.15.0; 8.14.1; 8.14.0; 8.13.0; 8.12.1; 8.12.0; 8.11.1; 8.11.0; 8.10.1; 8.10.0; 8.9.1; 8.9.0; 8.8.0; 8.7.1; 8.7.0; 8.6.0; 8.5.0; 8.4.0; 8.3.0; 8.2.1; 8.2.0; 8.1.2; 8.1.1; 8.1.0; 8.0.1; 8.0.0; 7.88.1; 7.88.0; 7.87.0; 7.86.0; 7.85.0; 7.84.0; 7.83.1; 7.83.0; 7.82.0; 7.81.0; 7.80.0; 7.79.1; 7.79.0; 7.78.0; 7.77.0; 7.76.1; 7.76.0; 7.75.0; 7.74.0; 7.73.0; 7.72.0; 7.71.1; 7.71.0; 7.70.0; 7.69.1; 7.69.0; 7.68.0; 7.67.0; 7.66.0; 7.65.3; 7.65.2; 7.65.1; 7.65.0; 7.64.1; 7.64.0; 7.63.0; 7.62.0; 7.61.1; 7.61.0; 7.60.0; 7.59.0; 7.58.0 Fixed: See vendor advisory.
Why it matters
Review the vendor advisory and exposure of the affected product to determine operational impact.
Detection & mitigation
- Apply vendor-provided updates or mitigations.
- Review affected product exposure and access logs.