GHSA-fhw8-8j55-vwgq
Suggest an improvement- Source
- https://github.com/advisories/GHSA-fhw8-8j55-vwgq
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-fhw8-8j55-vwgq/GHSA-fhw8-8j55-vwgq.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-fhw8-8j55-vwgq
- Aliases
- Published
- 2022-11-16T12:00:18Z
- Modified
- 2023-11-01T05:00:20.410037Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Unsafe deserialization in Apache MINA SSHD
- Details
-
Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server.
Until version 2.1.0, the code affected by this vulnerability appeared in
org.apache.sshd:sshd-core. Version 2.1.0 contains a commit where the code was moved to the packageorg.apache.sshd:sshd-common, which did not exist until version 2.1.0. - References
-
- https://nvd.nist.gov/vuln/detail/CVE-2022-45047
- https://github.com/apache/mina-sshd/commit/03238d51586f6b3c0bdbb1a23cf16799344d6c32
- https://github.com/apache/mina-sshd/commit/10de190e7d3f9189deb76b8d08c72334a1fe2df0
- https://github.com/apache/mina-sshd/commit/5a8fe830b2a2308a2b24ac8115a391af477f64f5
- https://github.com/apache/mina-sshd
- https://www.mail-archive.com/dev@mina.apache.org/msg39312.html
Affected packages
Maven / org.apache.sshd:sshd-common
Package
- Name
- org.apache.sshd:sshd-common
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.sshd/sshd-common
Maven / org.apache.sshd:sshd-core
Package
- Name
- org.apache.sshd:sshd-core
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.sshd/sshd-core
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.9.2