CVE-2022-45047

Apache MINA SSHD: Java unsafe deserialization vulnerability

CVSS 9.8 CRITICALEPSS 3.6%CWE-502

Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Apache Software Foundation · Apache MINA SSHD

public PoCs found — 1

githubgithub.com/hktalent/CVE-2022-45047★ 2

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://security.netapp.com/advisory/ntap-20240216-0008/https://www.mail-archive.com/dev%40mina.apache.org/msg39312.html