CVE-2021-30129: DoS/OOM leak vulnerability in Apache Mina SSHD Server

Q: What is the severity of CVE-2021-30129?

The severity of CVE-2021-30129 is medium.

Q: Which versions of Apache Mina SSHD are affected by CVE-2021-30129?

Apache Mina SSHD version 2.0.0 and later versions are affected by CVE-2021-30129.

Q: How can an attacker exploit CVE-2021-30129?

An attacker can exploit CVE-2021-30129 by overflowing the server, causing an OutOfMemory error.

Q: Has CVE-2021-30129 been fixed?

Yes, CVE-2021-30129 has been fixed in Apache Mina SSHD 2.7.0.

Q: Where can I find more information about CVE-2021-30129?

You can find more information about CVE-2021-30129 in the references: [Reference 1](https://lists.apache.org/thread.html/r6d4f78e192a0c8eabd671a018da464024642980ecd24096bde6db36f%40%3Cusers.mina.apache.org%3E), [Reference 2](https://lists.apache.org/thread.html/r6d4f78e192a0c8eabd671a018da464024642980ecd24096bde6db36f@%3Cusers.mina.apache.org%3E), [Reference 3](https://github.com/apache/mina-sshd/pull/181/commits/5b5bd1dcfa0c2fc250e079e1eb).

Published Jul 12, 2021

Updated

A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache Mina SSHD 2.7.0

Affected Software

16 affected componentsFixes available

redhat/eap7-apache-sshd<0:2.7.0-1.redhat_00001.1.el8ea

0:2.7.0-1.redhat_00001.1.el8ea

redhat/eap7-apache-sshd<0:2.7.0-1.redhat_00001.1.el7ea

0:2.7.0-1.redhat_00001.1.el7ea

redhat/mina-sshd<2.7.0

2.7.0

Apache sshd>=2.0.0<2.7.0

Oracle Banking Payments=14.5

Oracle Banking Trade Finance=14.5

Oracle Banking Treasury Management=14.5

Oracle Communications Cloud Native Core Console=1.9.0

Oracle FLEXCUBE Universal Banking>=14.0.0<=14.3.0

Oracle FLEXCUBE Universal Banking=14.5

Oracle Middleware Common Libraries And Tools=12.2.1.3.0

Oracle Middleware Common Libraries And Tools=12.2.1.4.0

Oracle Middleware Common Libraries And Tools=14.1.1.0.0

Oracle OSS Support Tools=2.12.42

Oracle Retail Customer Management and Segmentation Foundation=18.0

Oracle Retail Customer Management and Segmentation Foundation=19.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/eap7-apache-sshd to a version that resolves this vulnerability.
Fixed in 0:2.7.0-1.redhat_00001.1.el8ea
Upgrade
Upgrade redhat/eap7-apache-sshd to a version that resolves this vulnerability.
Fixed in 0:2.7.0-1.redhat_00001.1.el7ea
Upgrade
Upgrade redhat/mina-sshd to a version that resolves this vulnerability.
Fixed in 2.7.0
Upgrade
Upgrade Apache Mina SSHD to a version that resolves this vulnerability.
Fixed in 2.7.0
Compensating control
Limit exposure/usage of Apache Mina SSHD’s SFTP and port forwarding features until the server is upgraded to Apache Mina SSHD 2.7.0, since the issue affects these features in Mina SSHD 2.0.0 and later.

Event History

Jul 12, 2021

CVE Published

12:00 AM

CVE Published

via MITRE·12:10 PM

Data Sourced

via MITRE·12:10 PM

DescriptionWeakness

Data Sourced

via Red Hat·06:16 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the severity of CVE-2021-30129?

The severity of CVE-2021-30129 is medium.

Which versions of Apache Mina SSHD are affected by CVE-2021-30129?

Apache Mina SSHD version 2.0.0 and later versions are affected by CVE-2021-30129.

How can an attacker exploit CVE-2021-30129?