by Kastro
Paper/Archive/CVE-2022-45047

CVE-2022-45047

Apache Software Foundation Apache MINA SSHD — Apache MINA SSHD: Java unsafe deserialization vulnerability

EPSS 4%public exploitCVSS 9.8
critical.is priorityof 100
57
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 90.0.900 × 2018.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server.

Affected

ProductAffectedFixed inSource
Apache MINA SSHDunspecified – 2.9.1–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refmail-archive.com/dev%40mina.apache.org/msg39312.htmlrefsecurity.netapp.com/advisory/ntap-20240216-0008