Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:48458
HistoryAug 13, 2024 - 5:36 a.m.

Improper Validation Of Integrity Check Value

2024-08-1305:36:21
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
1
org.apache.sshd
software
vulnerability
packet interception
terrapin attack
security compromise

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

7.2

Confidence

High

EPSS

0.001

Percentile

27.3%

org.apache.sshd, sshd-common is vulnerable for Improper Validation Of Integrity Check Value. The vulnerability is due to the possibility of packet interception, where an attacker can intercept traffic between the client and server and drop certain packets from the stream, potentially downgrading or disabling some security features. Attackers can exploit this to conduct a Terrapin attack, compromising the security of the connection.

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

7.2

Confidence

High

EPSS

0.001

Percentile

27.3%