CVE-2018-6517

7.5 highEPSS 0.9%

Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints for previously unknown hosts getting added to the user's known_hosts file without confirmation. In version 0.3.0 this is updated so that the user's known_hosts file is not updated by chloride.

Severity

CVSS 3.0

7.5 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-31)
CWE: CWE-295
Published: 2019-03-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

puppet:chloride

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-573x-jhqh-jg36	RubyGems	chloride	<0.3.0	0.3.0

References

https://puppet.com/security/cve/CVE-2018-6517
https://puppet.com/security/cve/CVE-2018-6517

Check your stack JSON