The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the openssh-8.7p1-45.el9 build changelog.

  - A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle     attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how     OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be     considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning     the attack complexity high. (CVE-2025-26465)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

CentOS 9 : openssh-8.7p1-45.el9

medium Nessus Plugin ID 216704

Version 1.1