Unbbal

**Name of the Vulnerable Software and Affected Versions** Apache MINA SSHD versions prior to 2.0.0 Apache MINA SSHD versions 2.0.0 through 2.18.f **Description** A path traversal issue exists in the sshd-scp component of Apache MINA SSHD, a Java library for client-side and server-side SSH. The implementation for receiving files or directories via SCP fails to validate filenames in SCP "C" or "D" commands. This allows a malicious sender to provide filenames containing paths, enabling files to be written in locations controlled by the attacker. **Recommendations** Upgrade to version 2.19.0. Upgrade to version 3.0.0-M5.

**Name of the Vulnerable Software and Affected Versions** Apache MINA SSHD versions 2.18.0 through 2.18.x Apache MINA SSHD versions 3.0.0-M1 through 3.0.0-M4 **Description** Path traversal on Windows in the `sshd-git` component of Apache MINA SSHD, a Java library for client-side and server-side SSH. An authenticated remote user can access git repositories located outside of the configured server-side root directory. This occurs because path validation was partly ineffective for servers running on Windows. **Recommendations** Upgrade versions 2.18.0 through 2.18.x to 2.19.0. Upgrade versions 3.0.0-M1 through 3.0.0-M4 to 3.0.0-M5.

**Name of the Vulnerable Software and Affected Versions** Apache MINA SSHD versions prior to 2.19.0 Apache MINA SSHD versions prior to 3.0.0-M5 **Description** Improper input validation in the `sshd-git` component of Apache MINA SSHD, specifically within the `GitPgmCommandFactory`, allows an authenticated SSH user to execute arbitrary JGit commands. This can lead to unauthorized file writes at arbitrary locations on the server, for example, by using the `git archive` command with the `--output` option. **Recommendations** Upgrade to version 2.19.0. Upgrade to version 3.0.0-M5. As a temporary mitigation, avoid configuring the `GitPgmCommandFactory` on the server.