CVE-2023-48795

The SSH transport protocol, including OpenSSH (before 9.6), is vulnerable to the Terrapin attack (CVE-2023-48795). This vulnerability allows remote attackers to bypass integrity checks during the handshake phase by exploiting how the SSH Binary Packet Protocol (BPP) handles sequence numbers. The ...

CVE-2023-35887

CVE-2023-35887 affects Apache MINA SSHD when using RootedFileSystem in SFTP servers. The root cause is path traversal outside the rooted tree via paths with '..' or symlinks, allowing logged-in users to discover existence/non-existence of items outside the rooted directory. Affected: Apache MINA ...

CVE-2022-45047

CVE-2022-45047 affects Apache MINA SSHD (SSHD) where SimpleGeneratorHostKeyProvider uses Java deserialization to load a PrivateKey, enabling remote authenticated code execution via unsafe deserialization. The issue is in MINA SSHD

CVE-2021-30129

CVE-2021-30129 affects Apache Mina SSHD's sshd-core; a crafted request can trigger an OutOfMemory DoS in the SFTP and port forwarding features. Remediation: upgrade to Apache Mina SSHD 2.7.0 (fix documented in the IBM PEM advisory referencing this CVE). If applying via IBM PEM, follow their patch...