CVE-2025-15079

A flaw was found in curl. When performing SSH-based transfers using SCP or SFTP, libcurl could mistakenly connect to hosts not listed in the user-specified knownhosts file. This occurs if the host is present in the libssh global knownhosts file, effectively bypassing the intended host verification. This could allow a remote attacker to connect to an untrusted host, potentially leading to information disclosure or man-in-the-middle attacks.

This vulnerability is rated Important for Red Hat because libcurl, when configured for SSH-based transfers (SCP/SFTP) with a user-specified knownhosts file, may bypass this configuration and accept connections to hosts present in the system-wide libssh global knownhosts file. This could lead to unintended host trust in specific deployment scenarios.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure that the system-wide libssh global knownhosts file (/etc/ssh/ssh_known_hosts) does not contain entries for untrusted hosts. Alternatively, avoid using libcurl for SCP or SFTP transfers in environments where strict enforcement of a user-specified knownhosts file is critical and the system-wide knownhosts file cannot be fully controlled. Services relying on libssh for host key verification may need to be restarted to apply the changes.