CVE-2022-45047: Apache MINA SSHD: Java unsafe deserialization vulnerability

Published Nov 16, 2022
·
Updated

A flaw was found in Apache MINA SSHD, when using Java deserialization to load a serialized java.security.PrivateKey. An attacker could benefit from unsafe deserialization by inserting unsecured data that may affect the application or server.

Other sources

Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server.

Affected Software

16 affected componentsFixes available
maven/org.apache.sshd:sshd-core<2.1.0
2.9.2
maven/org.apache.sshd:sshd-common<2.9.2
2.9.2
redhat/jenkins<2-plugins-0:4.11.1683009941-1.el8
2-plugins-0:4.11.1683009941-1.el8
redhat/jenkins<2-plugins-0:4.12.1675702407-1.el8
2-plugins-0:4.12.1675702407-1.el8
redhat/eap7-apache-sshd<0:2.9.2-1.redhat_00001.1.el8ea
0:2.9.2-1.redhat_00001.1.el8ea
redhat/eap7-apache-sshd<0:2.9.2-1.redhat_00001.1.el9ea
0:2.9.2-1.redhat_00001.1.el9ea
redhat/eap7-apache-sshd<0:2.9.2-1.redhat_00001.1.el7ea
0:2.9.2-1.redhat_00001.1.el7ea
redhat/jenkins<2-plugins-0:4.10.1675144701-1.el8
2-plugins-0:4.10.1675144701-1.el8
redhat/jenkins<2-plugins-0:4.9.1675668922-1.el8
2-plugins-0:4.9.1675668922-1.el8
redhat/rh-sso7-keycloak<0:18.0.6-1.redhat_00001.1.el7
0:18.0.6-1.redhat_00001.1.el7
redhat/rh-sso7-keycloak<0:18.0.6-1.redhat_00001.1.el8
0:18.0.6-1.redhat_00001.1.el8
redhat/rh-sso7-keycloak<0:18.0.6-1.redhat_00001.1.el9
0:18.0.6-1.redhat_00001.1.el9
redhat/vdsm<0:4.50.3.6-1.el8e
0:4.50.3.6-1.el8e
redhat/apache-sshd<1:2.9.2-0.1.el8e
1:2.9.2-0.1.el8e
Apache sshd<=2.9.1
redhat/sshd<2.9.2
2.9.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade maven/org.apache.sshd:sshd-core to a version that resolves this vulnerability.

    Fixed in 2.9.2
  2. Upgrade

    Upgrade maven/org.apache.sshd:sshd-common to a version that resolves this vulnerability.

    Fixed in 2.9.2
  3. Upgrade

    Upgrade redhat/jenkins to a version that resolves this vulnerability.

    Fixed in 2-plugins-0:4.11.1683009941-1.el8
  4. Upgrade

    Upgrade redhat/jenkins to a version that resolves this vulnerability.

    Fixed in 2-plugins-0:4.12.1675702407-1.el8
  5. Upgrade

    Upgrade redhat/eap7-apache-sshd to a version that resolves this vulnerability.

    Fixed in 0:2.9.2-1.redhat_00001.1.el8ea
  6. Upgrade

    Upgrade redhat/eap7-apache-sshd to a version that resolves this vulnerability.

    Fixed in 0:2.9.2-1.redhat_00001.1.el9ea
  7. Upgrade

    Upgrade redhat/eap7-apache-sshd to a version that resolves this vulnerability.

    Fixed in 0:2.9.2-1.redhat_00001.1.el7ea
  8. Upgrade

    Upgrade redhat/jenkins to a version that resolves this vulnerability.

    Fixed in 2-plugins-0:4.10.1675144701-1.el8
  9. Upgrade

    Upgrade redhat/jenkins to a version that resolves this vulnerability.

    Fixed in 2-plugins-0:4.9.1675668922-1.el8
  10. Upgrade

    Upgrade redhat/rh-sso7-keycloak to a version that resolves this vulnerability.

    Fixed in 0:18.0.6-1.redhat_00001.1.el7
  11. Upgrade

    Upgrade redhat/rh-sso7-keycloak to a version that resolves this vulnerability.

    Fixed in 0:18.0.6-1.redhat_00001.1.el8
  12. Upgrade

    Upgrade redhat/rh-sso7-keycloak to a version that resolves this vulnerability.

    Fixed in 0:18.0.6-1.redhat_00001.1.el9
  13. Upgrade

    Upgrade redhat/vdsm to a version that resolves this vulnerability.

    Fixed in 0:4.50.3.6-1.el8e
  14. Upgrade

    Upgrade redhat/apache-sshd to a version that resolves this vulnerability.

    Fixed in 1:2.9.2-0.1.el8e
  15. Upgrade

    Upgrade redhat/sshd to a version that resolves this vulnerability.

    Fixed in 2.9.2
  16. Upgrade

    Upgrade Apache MINA SSHD to a version that resolves this vulnerability.

    Fixed in 2.9.1
  17. Configuration

    For Apache MINA SSHD <= 2.9.1, do not use org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to generate and later load your server's host key.

    Apache MINA SSHD org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider = do not use (for Apache MINA SSHD <= 2.9.1)
  18. Configuration

    Instead of SimpleGeneratorHostKeyProvider, use a custom implementation that uses the OpenSSH format for storing/loading the host key (OpenSSHKeyPairResourceWriter/OpenSSHKeyPairResourceParser), or generate host key files separately (e.g., OpenSSH format) and load them via org.apache.sshd.common.keyprovider.FileKeyPairProvider.

    Apache MINA SSHD Host key generation/loading implementation = use a custom implementation (OpenSSH format) or use FileKeyPairProvider with separately generated host keys

Event History

Nov 16, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Data Sourced
via NVD·09:15 AM
DescriptionSeverityWeaknessAffected Software
Advisory Published
12:00 PM
Nov 23, 2022
Data Sourced
via Red Hat·01:36 PM
DescriptionSeverityAffected Software
Apr 7, 2023
Exploit Published
via GitHub·03:16 AM

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is CVE-2022-45047?

CVE-2022-45047 is a vulnerability found in Apache MINA SSHD that allows for arbitrary code execution.

2

How severe is CVE-2022-45047?

CVE-2022-45047 has a severity rating of critical, with a CVSS score of 9.8.

3

What is the affected software for CVE-2022-45047?

The affected software for CVE-2022-45047 includes Apache MINA SSHD versions <= 2.9.1, org.apache.sshd:sshd-core version <= 2.1.0, and org.apache.sshd:sshd-common version <= 2.9.2.

4

How do I fix CVE-2022-45047?

To fix CVE-2022-45047, upgrade to Apache MINA SSHD 2.9.2 or later, org.apache.sshd:sshd-core 2.1.0 or later, or org.apache.sshd:sshd-common 2.9.2 or later.

5

Where can I find more information about CVE-2022-45047?

You can find more information about CVE-2022-45047 on the NIST NVD website, the Apache MINA SSHD mailing list, and the GitHub commit page.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203