THE INFORMATION IN THIS ARTICLE APPLIES TO:

• EFT 8.1 or older

QUESTION

• Is EFT vulnerable to the CVE-2020-14145 vulnerability?

ANSWER

No. EFT uses OpenSSH differently and does not order host key algorithms, as a result this vulnerability does not apply to EFT.

If you want to avoid this false positive in your environment, update to EFT 8.2.1 that uses a newer version of OpenSSH.

Additionally, when your EFT server connects to an external server, you must define the connection profile with a valid and accessible path to the certificate. For detailed instructions refer to our online documentation: Defining a Connection Profile. If clients are connecting to your EFT server, they need to include your certificate in their connection string.

MORE INFORMATION

Online article about discovery of vulnerability: CVSS 5.9 CVE-2020-14145 — SSH-MITM

CVE website: CVE: Common Vulnerabilities and Exposures