CVE-2022-45047
critical
CVSS v3
9.8
CVSS v2
—
VIR risk
9.8
Description
Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server.
Predictions
Exploit likelihood
97%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2022-45047
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | forky | fixed | 0 |
| debian | sid | fixed | 0 |
| debian | trixie | fixed | 0 |
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Maven | org.apache.sshd:sshd-common | <2.9.2 | 2.9.2 |
| Maven | org.apache.sshd:sshd-core | <2.9.2 | 2.9.2 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| apache | sshd | {"endIncluding":"2.9.1"} | |
References
- https://security.netapp.com/advisory/ntap-20240216-0008/
- https://www.mail-archive.com/dev%40mina.apache.org/msg39312.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-45047
- https://github.com/apache/mina-sshd/commit/03238d51586f6b3c0bdbb1a23cf16799344d6c32
- https://github.com/apache/mina-sshd/commit/10de190e7d3f9189deb76b8d08c72334a1fe2df0
- https://github.com/apache/mina-sshd/commit/5a8fe830b2a2308a2b24ac8115a391af477f64f5
- https://github.com/apache/mina-sshd
- https://www.mail-archive.com/dev@mina.apache.org/msg39312.html
- https://security-tracker.debian.org/tracker/CVE-2022-45047
CWEs
CWE-502
Verify integrity in audit chain (admin only). AS-IS.