GitHub Advisoryadvisory · Maven

GHSA-fhw8-8j55-vwgq Unsafe deserialization in Apache MINA SSHD

CRITICAL Published 2022-11-16 Modified 2023-08-18 Official page ↗
Aliases
CVE-2022-45047
Ecosystem
Maven
Packages
org.apache.sshd:sshd-common, org.apache.sshd:sshd-core
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2022-11-21

Affected packages

• Maven org.apache.sshd:sshd-common: < 2.9.2 → fixed in 2.9.2 • Maven org.apache.sshd:sshd-core: < 2.9.2 → fixed in 2.9.2

Description

Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server. Until version 2.1.0, the code affected by this vulnerability appeared in `org.apache.sshd:sshd-core`. Version 2.1.0 contains a commit where the code was moved to the package `org.apache.sshd:sshd-common`, which did not exist until version 2.1.0.

Related

Alias · CVE (1)

  • CVE-2022-45047 Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References