CVE-2022-45047

Critical

Published: 16/11/2022(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD versions up to 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. It is one of several implementations that can be used for loading the host keys of an SSH server.

Risk Assessment

Exploitation of this vulnerability may lead to unauthorized access to private keys, jeopardizing the security of the SSH server and the data stored within it.

Recommendation

It is recommended to upgrade Apache MINA SSHD to a version newer than 2.9.1 to mitigate the risks associated with object deserialization.

Original NVD description (English source)

Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server.