[<prev] [next>] [day] [month] [year] [list]
Message-ID: <de322975-cce4-72a7-13b5-fa3b8b6b0622@apache.org>
Date: Mon, 12 Aug 2024 15:59:56 +0000
From: Arnout Engelen <engelen@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-41909: Apache MINA SSHD: integrity check bypass
Severity: moderate
Affected versions:
- Apache MINA SSHD through 2.11.0
Description:
Like many other SSH implementations, Apache MINA SSHD suffered from the issue that is more widely known as CVE-2023-48795. An attacker that can intercept traffic between client and server could drop certain packets from the stream, potentially causing client and server to consequently end up with a connection for which
some security features have been downgraded or disabled, aka a Terrapin
attack
The mitigations to prevent this type of attack were implemented in Apache MINA SSHD 2.12.0, both client and server side. Users are recommended to upgrade to at least this version. Note that both the client and the server implementation must have mitigations applied against this issue, otherwise the connection may still be affected.
Credit:
Fabian Bäumer (finder)
References:
https://github.com/apache/mina-sshd/issues/445
https://mina.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-41909
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
