PT-2024-29627 · Apache · Apache Mina Sshd

Fabian Bäumer · Published 2024-08-12 · Updated 2024-08-30 · CVE-2024-41909

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache MINA SSHD versions prior to 2.12.0

Description The issue, also known as a Terrapin attack, allows an attacker who can intercept traffic between the client and server to drop certain packets, potentially downgrading or disabling some security features. This could cause the client and server to end up with a connection that has reduced security.

Recommendations For Apache MINA SSHD versions prior to 2.12.0, upgrade to at least version 2.12.0 to apply the necessary mitigations against this issue. Ensure that both the client and server implementations are updated, as only updating one may not fully prevent the attack.

Fix

Weakness Enumeration

CWE-354

Related Identifiers

CVE-2024-41909

GHSA-2326-HX7G-3M9R

Affected Products

Apache Mina Sshd

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2024-41909 · Security Note
• https://lists.apache.org/thread/vwf1ot8wx1njyy8n19j5j2tcnjnozt3b · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2326-hx7g-3m9r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-41909 · Vendor Advisory
• https://github.com/apache/mina-sshd/issues/445 · Note
• https://github.com/apache/mina-sshd · Note
• https://github.com/apache/mina-sshd/pull/449 · Note
• https://github.com/apache/mina-sshd/commit/6b0fd46f64bcb75eeeee31d65f10242660aad7c1 · Note
• https://github.com/apache/mina-sshd/commit/315739e4e9d1dc7a4ff32ea64936982ed0b73e76 · Note
• https://github.com/apache/mina-sshd/commit/7b2c781640a7a78a9455b86593a1f63c9e8cab92 · Note
• https://github.com/apache/mina-sshd/releases/tag/sshd-2.12.0 · Note
• https://t.me/cvedetector/2863 · Telegram Post
• https://twitter.com/PorsilapongoCl/status/1823038059987796388 · Twitter Post
• https://security.netapp.com/advisory/ntap-20241011-0006 · Note
• https://twitter.com/oss_security/status/1823033700981871039 · Twitter Post