Vulnerability	Vulnerable Version
M Improper Check for Certificate Revocation Affected versions of this package are vulnerable to Improper Check for Certificate Revocation in the `known_hosts` parser, where `HostKey.name2type()` lacks OpenSSH certificate-type entries such as `ssh-ed25519-cert-v01@openssh.com` in its static table, so a `@revoked` line authored with a certificate-type token fails the lookup and is stored as an `UNKNOWN`, marker-less entry. An attacker holding a compromised host certificate can pass host verification despite that revocation entry, because `UNKNOWN` entries are excluded from `getHostKey()` and never reach `OpenSshCertificateUtil.getRevokedKeys()`, when the client's `known_hosts` `@revoked` line was written with the certificate type string. This requires OpenSSH certificate-based host authentication with `StrictHostKeyChecking=yes`, and the `@revoked` entry to have been authored using the certificate-type token rather than the base key type. How to fix Improper Check for Certificate Revocation? Upgrade `com.github.mwiede:jsch` to version 2.28.6 or higher.	[,2.28.6)

Improper Check for Certificate Revocation

Affected versions of this package are vulnerable to Improper Check for Certificate Revocation in the known_hosts parser, where HostKey.name2type() lacks OpenSSH certificate-type entries such as ssh-ed25519-cert-v01@openssh.com in its static table, so a @revoked line authored with a certificate-type token fails the lookup and is stored as an UNKNOWN, marker-less entry. An attacker holding a compromised host certificate can pass host verification despite that revocation entry, because UNKNOWN entries are excluded from getHostKey() and never reach OpenSshCertificateUtil.getRevokedKeys(), when the client's known_hosts @revoked line was written with the certificate type string. This requires OpenSSH certificate-based host authentication with StrictHostKeyChecking=yes, and the @revoked entry to have been authored using the certificate-type token rather than the base key type.

How to fix Improper Check for Certificate Revocation?

Upgrade com.github.mwiede:jsch to version 2.28.6 or higher.

[,2.28.6)

Go back to all versions of this package