CVE-2014-8779

High

Published: 03/02/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

Pexip Infinity before version 8 uses the same SSH host keys across different customers' installations, allowing man-in-the-middle attackers to spoof Management and Conferencing Nodes.

Risk Assessment

The use of the same SSH keys increases the risk of attacks that could lead to the compromise of communication between nodes, threatening the security of customer data.

Recommendation

It is recommended to upgrade to Pexip Infinity version 8 or later to mitigate the risks associated with the use of shared SSH keys.

Other vulnerabilities in Pexip Infinity

CVE-2017-6551Critical
Pexip Infinity before version 14.2 allows remote attackers to cause a denial of service (service restart) or execute arbitrary code via vectors related to Conferencing Nodes.

Original NVD description (English source)

Pexip Infinity before 8 uses the same SSH host keys across different customers' installations, which allows man-in-the-middle attackers to spoof Management and Conferencing Nodes by leveraging these keys.