PT-2021-4032 · Apache · Apache Mina Sshd

Published 2021-07-12 · Updated 2022-07-25 · CVE-2021-30129

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Mina SSHD versions 2.0.0 through 2.6.x

Description A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server, causing an OutOfMemory error. This issue affects the SFTP and port forwarding features.

Recommendations For Apache Mina SSHD versions 2.0.0 through 2.6.x, update to Apache Mina SSHD 2.7.0 to resolve the issue. As a temporary workaround, consider restricting access to the SFTP and port forwarding features until the update is applied.

Fix

Resource Exhaustion

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-400

CWE-772

Related Identifiers

BDU:2021-04559

CVE-2021-30129

GHSA-9279-7HPH-R3XW

OESA-2021-1312

RHSA-2021:4676

RHSA-2021:4677

Affected Products

Apache Mina Sshd

References · 19

• https://osv.dev/vulnerability/GHSA-9279-7hph-r3xw · Vendor Advisory
• https://lists.apache.org/thread.html/r6d4f78e192a0c8eabd671a018da464024642980ecd24096bde6db36f%40%3Cusers.mina.apache.org%3E · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://osv.dev/vulnerability/CVE-2021-30129 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1312 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-30129 · Security Note
• https://bdu.fstec.ru/vul/2021-04559 · Security Note
• https://issues.apache.org/jira/browse/SSHD-1125 · Note
• https://oracle.com/security-alerts/cpujul2022.html · Note
• https://t.me/cvenotify/17472 · Telegram Post
• https://lists.apache.org/thread.html/red01829efa2a8c893c4baff4f23c9312bd938543a9b8658e172b853b@%3Cannounce.apache.org%3E · Note
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1312 · Note
• http://openwall.com/lists/oss-security/2021/07/12/1 · Note
• https://lists.apache.org/thread.html/red01829efa2a8c893c4baff4f23c9312bd938543a9b8658e172b853b%40%3Cannounce.apache.org%3E · Note
• https://vuldb.com/?id.178275 · Note