Apache MINA SSHD up to 2.11.0 Terrapin integrity check

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Apache MINA SSHD up to 2.11.0. Impacted is an unknown function. Performing a manipulation results in integrity check. This vulnerability is identified as CVE-2024-41909. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Apache MINA SSHD up to 2.11.0. It has been classified as problematic. This affects an unknown functionality. The manipulation with an unknown input leads to a integrity check vulnerability. CWE is classifying the issue as CWE-354. The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission. This is going to have an impact on confidentiality. The summary by CVE is:

Like many other SSH implementations, Apache MINA SSHD suffered from the issue that is more widely known as CVE-2023-48795. An attacker that can intercept traffic between client and server could drop certain packets from the stream, potentially causing client and server to consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack The mitigations to prevent this type of attack were implemented in Apache MINA SSHD 2.12.0, both client and server side. Users are recommended to upgrade to at least this version. Note that both the client and the server implementation must have mitigations applied against this issue, otherwise the connection may still be affected.

The weakness was released by Fabian Bäumer as 445. It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2024-41909 since 07/23/2024. The exploitability is told to be difficult. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 2.12.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• SSH Server Software

Vendor

• Apache

Name

• MINA SSHD

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11.0

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion