Fluid Attacks Database

Description

Unsafe deserialization in Apache MINA SSHD Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server.

Until version 2.1.0, the code affected by this vulnerability appeared in org.apache.sshd:sshd-core. Version 2.1.0 contains a commit where the code was moved to the package org.apache.sshd:sshd-common, which did not exist until version 2.1.0.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
maven	org.apache.sshd:sshd-core	>=0 <2.9.2	2.9.2
maven	org.apache.sshd:sshd-common	>=0 <2.9.2	2.9.2
maven	org.apache.sshd:sshd	>=0 <=2.9.1	2.9.2

Aliases

1. CVE-2022-450472. NVD-2022-450473. OSV-2022-450474. GCVE-2022-45047

References

1. https://github.com/apache/mina-sshd/commit/03238d51586f6b3c0bdbb1a23cf16799344d6c322. https://github.com/apache/mina-sshd/commit/10de190e7d3f9189deb76b8d08c72334a1fe2df03. https://github.com/apache/mina-sshd/commit/5a8fe830b2a2308a2b24ac8115a391af477f64f54. https://www.mail-archive.com/[email protected]/msg39312.html5. https://github.com/hktalent/CVE-2022-45047

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.