High · 7.5 CVE-2024-41264 EUVD-2024-2511GHSA-67fw-w8f2-88wpGO-2024-3026

casdoor's use of`ssh.InsecureIgnoreHostKey()` disables host key verification

Published Aug 1, 2024 · Updated Aug 7, 2024 · Assigned by mitre

Description

An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method.

Ecosystem	Package	Affected	Fixed	Record
Go	github.com/casdoor/casdoor	>= 1.541.0, <= 1.636.0	—	GHSA-67fw-w8f2-88wp
Go	github.com/casdoor/casdoor	>= 1.541.0	—	GO-2024-3026