PT-2020-11336 · Apple · Ios+1

Published 2020-10-27 · Updated 2020-10-30 · CVE-2019-8901

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions iOS versions prior to 13.1 iPadOS versions prior to 13.1

Description The issue allows an attacker in a privileged network position to intercept SSH traffic from the "Run script over SSH" action. This is addressed by verifying host keys when connecting to a previously-known SSH server.

Recommendations For iOS versions prior to 13.1, update to iOS 13.1 or later to resolve the issue. For iPadOS versions prior to 13.1, update to iPadOS 13.1 or later to resolve the issue.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2019-8901

Affected Products

Ios

Ipados

References · 3

• https://osv.dev/vulnerability/CVE-2019-8901 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-8901 · Security Note
• https://support.apple.com/en-us/HT210603 · Vendor Advisory