~ / search / GHSA-8vq4-8hfp-29xh

GHSA-8vq4-8hfp-29xh

Eugeny Tabby Sends Password Despite Host Key Verification Failure

Source: GitHub Advisory Database (reviewed) High CVE-2024-48460

Packages

EcosystemPackageAffectedFixed in
npm tabby-ssh < 1.0.214 1.0.214

Details

As written in the advisory (Markdown source, shown as plain text).

An issue in Eugeny Tabby 1.0.213 allows a remote attacker to obtain sensitive information via the server and sends the SSH username and password even when the host key verification fails.

References

External links from the advisory. They lead to third-party sites.