Commits on Jan 6, 2022

1. Fix for CWE-295: Improper Certificate Validation …

   In the Secure Shell (SSH) protocol, host keys are used to verify the identity of remote hosts. Accepting unknown host keys may leave the connection open to man-in-the-middle attacks.
   
   Do not accept unknown host keys. In particular, do not set the default missing host key policy for the Paramiko library to either AutoAddPolicy or WarningPolicy. Both of these policies continue even when the host key is unknown. The default setting of RejectPolicy is secure because it throws an exception when it encounters an unknown host key.
   
   Reference: https://cwe.mitre.org/data/definitions/295.html
   Signed-off-by: Audun Nes <audun.nes@gmail.com>

   

   avnes committed Jan 6, 2022
   Configuration menu

   • View commit details
   • Copy full SHA for 5de1360
   • Browse repository at this point

   Copy the full SHA

   5de1360 View commit details

   Browse the repository at this point in the history