https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 14:27:49 +0000 https://db.gcve.eu/vuln/fkie_cve-2025-23390 <p>A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the `known_hosts` file. This could allow the execution of a man-in-the-middle (MitM) attack against Fleet. In case the server that is being connected to has a trusted entry in the known_hosts file, then Fleet will correctly check the authenticity of the presented certificate.</p> <p>A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the `known_hosts` file. This could allow the execution of a man-in-the-middle (MitM) attack against Fleet. In case the server that is being connected to has a trusted entry in the known_hosts file, then Fleet will correctly check the authenticity of the presented certificate.</p> https://db.gcve.eu/vuln/fkie_cve-2025-23390 https://db.gcve.eu/vuln/ghsa-xgpc-q899-67p8 <p><strong>Affected:</strong> Go: github.com/rancher/fleet</p> <p>### Impact A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the `known_hosts` file. This could allow the execution of a man-in-the-middle (MitM) attack against Fleet. In case the server that is being connected to has a trusted entry in the known_hosts file, then Fleet will correctly check the authenticity of the presented certificate.</p> <p>Please consult the associated [MITRE ATT&amp;CK - Technique - Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557/) for further information about this category of attack.</p> <p>### Patches Patched versions include releases `v0.10.12`, `v0.11.7` and `v0.12.2`.</p> <p>The fix involves some key areas with the following changes:</p> <p>- Git latest commit fetcher sources `known_hosts` entries from the following locations, in decreasing order of priority: 1. Secret referenced in a `GitRepo`’s `clientSecretName` field; 2. If no secret is referenced, in a `gitcredential` secret located in the `GitRepo`’s namespace; 3. If that secret does not exist, in a (new) `known-hosts` config map installed by Fleet, populated statically with public entries shared by a few git providers: Github, Gitlab, Bitbucket, Azure DevOps;</p> <p>- Git cloner: same as above.</p> <p>- `fleet apply` command: same as above. The command reads entries from a `FLEET_KNOWN_HOSTS` environment variable. That command is typically run within a container insid…</p> <p><strong>Affected:</strong> Go: github.com/rancher/fleet</p> <p>### Impact A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the `known_hosts` file. This could allow the execution of a man-in-the-middle (MitM) attack against Fleet. In case the server that is being connected to has a trusted entry in the known_hosts file, then Fleet will correctly check the authenticity of the presented certificate.</p> <p>Please consult the associated [MITRE ATT&amp;CK - Technique - Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557/) for further information about this category of attack.</p> <p>### Patches Patched versions include releases `v0.10.12`, `v0.11.7` and `v0.12.2`.</p> <p>The fix involves some key areas with the following changes:</p> <p>- Git latest commit fetcher sources `known_hosts` entries from the following locations, in decreasing order of priority: 1. Secret referenced in a `GitRepo`’s `clientSecretName` field; 2. If no secret is referenced, in a `gitcredential` secret located in the `GitRepo`’s namespace; 3. If that secret does not exist, in a (new) `known-hosts` config map installed by Fleet, populated statically with public entries shared by a few git providers: Github, Gitlab, Bitbucket, Azure DevOps;</p> <p>- Git cloner: same as above.</p> <p>- `fleet apply` command: same as above. The command reads entries from a `FLEET_KNOWN_HOSTS` environment variable. That command is typically run within a container insid…</p> https://db.gcve.eu/vuln/ghsa-xgpc-q899-67p8 https://db.gcve.eu/vuln/opensuse-su-2025:15059-1 <p>govulncheck-vulndb-0.0.20250506T153719-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250506T153719-1.1 on GA media</p> https://db.gcve.eu/vuln/opensuse-su-2025:15059-1