Vulnerability of the org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider class in the Java library for supporting SSH protocol by Apache SSHD, allowing a hacker to execute arbitrary code.

🗓️ 12 Dec 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 3 Views

Vulnerability in SimpleGeneratorHostKeyProvider of Apache SSHD allows remote code execution via deserialization.

Reporter	Title	Published	Views	Family All 127
IBM Security Bulletins	Security Bulletin: IBM Tivoli Netcool Impact is vulnerable to unsafe deserialization due to Apache MINA SSHD (CVE-2022-45047)	21 Dec 202219:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilties affects IBM DB2 Data Management Console	6 Mar 202609:25	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability has been identified in the IBM Spectrum Scale GUI where a remote authenticated user can execute commands [CVE-2022-45047]	14 Apr 202311:30	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities affecting IBM Knowledge Catalog for IBM Cloud Pak for Data	1 Jun 202523:30	–	ibm
GithubExploit	Exploit for Deserialization of Untrusted Data in Apache Sshd	7 Apr 202303:16	–	githubexploit
ATTACKERKB	CVE-2022-45047	16 Nov 202209:15	–	attackerkb
Broadcom	Deserialization of Untrusted Data affecting org.apache.sshd:sshd-common package (CVE-2022-45047)	23 May 202400:00	–	broadcom
Circl	CVE-2022-45047	17 Nov 202215:58	–	circl
CNNVD	Apache MINA 代码问题漏洞	16 Nov 202200:00	–	cnnvd
CNVD	Apache MINA Deserialization Vulnerability	18 Nov 202200:00	–	cnvd

Vulners

Node

red_hat red_hat_jboss_fuseMatch7

OR

red_hat red_hat_single_sign-onMatch7

OR

red_hat red_hat_jboss_fuseMatch6

OR

red_hat red_hat_descision_managerMatch7

OR

red_hat red_hat_jboss_data_gridMatch7

OR

red_hat red_hat_virtualization_engineMatch4.4

OR

red_hat red_hat_jboss_fuse_service_worksMatch6

OR

red_hat red_hat_openshift_container_platformMatch3.11

OR

red_hat red_hat_openshift_container_platformMatch4.10

OR

red_hat red_hat_openshift_container_platformMatch4.9

OR

red_hat migration_toolkit_for_applicationsMatch6

OR

red_hat red_hat_jboss_enterprise_application_platformMatch7

OR

red_hat openshift_developer_tools_and_services_for_ocpMatch4.11

OR

sonarsource sonarqubeMatch9.3.3

OR

red_hat red_hat_process_automation_managerMatch7.13.4

OR

red_hat red_hat_jboss_enterprise_application_platformMatch6

OR

red_hat red_hat_integration_camel_for_spring_bootMatch3.18.3.p2

OR

red_hat red_hat_build_of_quarkusMatch2.7.6.sp3

OR

red_hat red_hat_data_gridMatch8.4.1

OR

red_hat openshift_developer_tools_and_services_for_ocpMatch4.12

OR

red_hat red_hat_data_gridMatch8.4.4

OR

apache sshdRange≤2.9.1

Source	Link
mail-archive	www.mail-archive.com/dev%40mina.apache.org/msg39312.html
access	www.access.redhat.com/security/cve/CVE-2022-45047
suse	www.suse.com/security/cve/CVE-2022-45047.html
web	www.web.nvd.nist.gov/view/vuln/detail

12 Dec 2023 00:00Current

7.1High risk

Vulners AI Score7.1

CVSS 39.8

CVSS 210

EPSS0.03571

apache sshd host key provider deserialization flaw remote code execution simplegeneratorhostkeyprovider