Apache SSHD is a 100% pure java library to support the SSH protocols on both the client and server side.
Security Fix(es):
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA.
In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" information about items outside the rooted tree via paths including parent navigation ("..") beyond the root, or involving symlinks.
This issue affects Apache MINA: from 1.0 before 2.10. Users are recommended to upgrade to 2.10 (CVE-2023-35887)
{ "severity": "Medium" }
{ "src": [ "apache-sshd-2.9.2-2.oe2203.src.rpm", "apache-sshd-2.9.2-2.oe2203sp1.src.rpm", "apache-sshd-2.9.2-2.oe2203sp2.src.rpm", "apache-sshd-2.9.2-2.oe2203sp3.src.rpm" ], "noarch": [ "apache-sshd-javadoc-2.9.2-2.oe2203.noarch.rpm", "apache-sshd-2.9.2-2.oe2203.noarch.rpm", "apache-sshd-2.9.2-2.oe2203sp1.noarch.rpm", "apache-sshd-javadoc-2.9.2-2.oe2203sp1.noarch.rpm", "apache-sshd-javadoc-2.9.2-2.oe2203sp2.noarch.rpm", "apache-sshd-2.9.2-2.oe2203sp2.noarch.rpm", "apache-sshd-javadoc-2.9.2-2.oe2203sp3.noarch.rpm", "apache-sshd-2.9.2-2.oe2203sp3.noarch.rpm" ] }