[GHSA-p86c-663x-5pxq] Add SSH and SFTP affected-package metadata

advisories/unreviewed/2026/10/GHSA-p86c-663x-5pxq/GHSA-p86c-663x-5pxq.json

@@ -1,19 +1,59 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-p86c-663x-5pxq",
-  "modified": "2026-10-16T15:38:29Z",
+  "modified": "2026-10-16T15:39:31Z",
   "published": "2026-10-16T00:31:59Z",
   "aliases": [
     "CVE-2026-94134"
   ],
+  "summary": "Apache Airflow SSH and SFTP providers disable host-key verification by default",
   "details": "The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends.\n\nUsers of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both.",
   "severity": [
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "apache-airflow-providers-ssh"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "7.0.0"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "apache-airflow-providers-sftp"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "7.0.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
@@ -23,6 +63,18 @@
       "type": "WEB",
       "url": "https://github.com/apache/airflow/pull/73419"
     },
+    {
+      "type": "WEB",
+      "url": "https://airflow.apache.org/docs/apache-airflow-providers-sftp/stable/changelog.html"
+    },
+    {
+      "type": "WEB",
+      "url": "https://airflow.apache.org/docs/apache-airflow-providers-ssh/stable/changelog.html"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/apache/airflow"
+    },
     {
       "type": "WEB",
       "url": "https://lists.apache.org/thread/ksr1lztvd3zr74f8xd1hzch1ssl0l3lj"