PT-2023-7055 · Apache · Apache Mina

Andrew Pikler · Publicado 2023-07-10 · Atualizado 2024-01-19 · CVE-2023-35887

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache MINA versions 1.0 through 2.9.3

Description The issue is related to the exposure of sensitive information to unauthorized actors in Apache MINA SSHD SFTP servers that use a RootedFileSystem. Logged users may be able to discover "exists/does not exist" information about items outside the rooted tree via paths including parent navigation ("..") beyond the root, or involving symlinks.

Recommendations For Apache MINA versions 1.0 through 2.9.3, upgrade to version 2.10 to resolve the issue. As a temporary workaround, consider restricting access to the RootedFileSystem to minimize the risk of exploitation.

Correção

Path traversal

Information Disclosure

Enumeração de Fraquezas

CWE-22

CWE-200

Identificadores relacionados

BDU:2023-08077

CVE-2023-35887

GHSA-MJMQ-GWGM-5QHM

OESA-2024-1079

RHSA-2023:7637

RHSA-2023:7638

RHSA-2023:7639

RHSA-2024:1192

RHSA-2024:1193

Produtos afetados

Apache Mina

Referências · 18

• https://github.com/apache/mina-sshd/commit/a61e93035f06bff8fc622ad94870fb773d48b9f0 · Nota
• https://github.com/apache/mina-sshd · Nota
• https://github.com/apache/mina-sshd/pull/362 · Nota
• https://github.com/apache/mina-sshd/commit/c20739b43aab0f7bf2ccad982a6cb37b9d5a8a0b · Nota
• https://github.com/apache/mina-sshd/commit/10de190e7d3f9189deb76b8d08c72334a1fe2df0 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-35887 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-35887 · Aviso do Fabricante
• https://lists.apache.org/thread/b9qgtqvhnvgfpn0w1gz918p21p53tqk2 · Aviso do Fabricante
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1079 · Nota
• https://osv.dev/vulnerability/GHSA-mjmq-gwgm-5qhm · Aviso do Fabricante
• https://t.me/cibsecurity/66258 · Publicação no Telegram
• https://github.com/advisories/GHSA-mjmq-gwgm-5qhm · Nota
• https://issues.apache.org/jira/browse/SSHD-1324 · Nota
• https://t.me/cvenotify/54619 · Publicação no Telegram
• https://vuldb.com/?id.233305 · Nota