Description
A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| LY | Central Dogma | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.linecorp.centraldogma:centraldogma-server-mirror-git | < 0.84.0 | 0.84.0 | GHSA-vjfw-cpmh-xwv3 |