Source: rex X-Debbugs-CC: [email protected] Severity: important Tags: security
Hi, The following vulnerability was published for rex. CVE-2026-94140[0]: | Rex versions through 1.16.1 for Perl accept an unknown SSH host key | for remote rsync transfers because sync hardcodes | StrictHostKeyChecking=no. Every remote branch of sync builds its | ssh command with that option, for password authentication, for | private-key authentication and for the fallback. The ssh options a | caller sets through set_openssh_opt reach the OpenSSH transport but | not this command, so there is no configuration that restores host | key checking for the transfer. An attacker who can redirect the | connection before the real host key is known presents their own and | the transfer proceeds: under password authentication sync sends the | connection password to that server, an upload writes the selected | local files to it, and a download writes what it returns to the | local destination. https://lists.security.metacpan.org/cve-announce/msg/44533736/ If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-94140 https://www.cve.org/CVERecord?id=CVE-2026-94140 Please adjust the affected versions in the BTS as needed.
