Bug#1151676: rex: CVE-2026-94140

[Moritz Mühlenhoff]

Source: rex
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for rex.

CVE-2026-94140[0]:
| Rex versions through 1.16.1 for Perl accept an unknown SSH host key
| for remote rsync transfers because sync hardcodes
| StrictHostKeyChecking=no.  Every remote branch of sync builds its
| ssh command with that option, for password authentication, for
| private-key authentication and for the fallback. The ssh options a
| caller sets through set_openssh_opt reach the OpenSSH transport but
| not this command, so there is no configuration that restores host
| key checking for the transfer.  An attacker who can redirect the
| connection before the real host key is known presents their own and
| the transfer proceeds: under password authentication sync sends the
| connection password to that server, an upload writes the selected
| local files to it, and a download writes what it returns to the
| local destination.

https://lists.security.metacpan.org/cve-announce/msg/44533736/


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-94140
    https://www.cve.org/CVERecord?id=CVE-2026-94140

Please adjust the affected versions in the BTS as needed.