iterate-ch/cyberduck

iterate-ch/cyberduck

Releases330

Frequency2 weeks 4 days

Last Release26 days ago

Stars4.65K

Cyberduck is a libre FTP, SFTP, WebDAV, Amazon S3, Backblaze B2, Microsoft Azure & OneDrive and OpenStack Swift file transfer client for Mac and Windows.

Log in to subscribe

CVE History

CVE	Affected	Published	CVSS v3	CVSS v2
CVE-2025-41256NVD↗	—	Jun 25, 2025Wednesday, 25 June 2025, 10:15	7.4 HIGH	—
Cyberduck and Mountain Duck improper handle TLS certificate pinning for untrusted certificates (e.g., self-signed), since the certificate fingerprint is stored as SHA-1, although SHA-1 is considered weak. This issue affects Cyberduck: through 9.1.6; Mountain Duck: through 4.17.5.
CVE-2025-41255NVD↗	—	Jun 25, 2025Wednesday, 25 June 2025, 10:15	8 HIGH	—
Cyberduck and Mountain Duck improperly handle TLS certificate pinning for untrusted certificates (e.g., self-signed), unnecessarily installing it to the Windows Certificate Store of the current user without any restrictions. This issue affects Cyberduck through 9.1.6 and Mountain Duck through 4.17.5.
CVE-2014-2845NVD↗	< 4.4.4	Nov 15, 2017Wednesday, 15 November 2017, 18:29	5.9 MEDIUM	4.3 MEDIUM
Cyberduck before 4.4.4 on Windows does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof FTP-SSL servers via a certificate issued by an arbitrary root Certification Authority.