Vulnerability · Published Nov 16, 2022 · Assigned by apache
CVE-2022-45047Apache MINA SSHD: Java unsafe deserialization vulnerability
Critical 9.8
In plain English
A critical-severity unsafe deserialization in Apache MINA SSHD from Apache Software Foundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.8% (higher than 90% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.sshd:sshd-common | 2.9.2 | GHSA-fhw8-8j55-vwgq |
| Maven | org.apache.sshd:sshd-core | 2.9.2 | GHSA-fhw8-8j55-vwgq |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache MINA SSHD | unspecified – through 2.9.1 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H