Read the docs
TI-2023-17957 Aliases CVE-2023-35887GHSA-mjmq-gwgm-5qhm

Apache MINA SSHD: Information disclosure bugs with RootedFilesystem

Priority LOW 25CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 9 fixed, 9 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.

Summary

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA. In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" information about items outside the rooted tree via paths including parent navigation ("..") beyond the root, or involving symlinks. This issue affects Apache MINA: from 1.0 before 2.10. Users are recommended to upgrade to 2.10

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01311 70th percentileScored 2026-11-07
Fix Partial Apache MINA SSHD (Apache Software Foundation): 2.10org.apache.sshd:sshd-common (Maven): 2.9.3+2 more productsRed Hat: 9 advisoriesRed Hat: 9 fixed, 9 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache MINA SSHD1.0 to before 2.102.10Patch availableCNA
—org.apache.sshd:sshd-common (Maven)2.1.0 to before 2.9.32.9.3Patch availableGHSA-mjmq-gwgm-5qhm
—org.apache.sshd:sshd-sftp (Maven)1.0.0 to before 2.9.32.9.3Patch availableGHSA-mjmq-gwgm-5qhm
—org.apache.sshd:sshd-core (Maven)1.0.0 to before 2.1.02.1.0Patch availableGHSA-mjmq-gwgm-5qhm
  • Apache MINA SSHD VendorApache Affected 1.0 to before 2.10 Fixed in 2.10 Patch available CNA
  • org.apache.sshd:sshd-common (Maven) Vendor— Affected 2.1.0 to before 2.9.3 Fixed in 2.9.3 Patch available GHSA-mjmq-gwgm-5qhm
  • org.apache.sshd:sshd-sftp (Maven) Vendor— Affected 1.0.0 to before 2.9.3 Fixed in 2.9.3 Patch available GHSA-mjmq-gwgm-5qhm
  • org.apache.sshd:sshd-core (Maven) Vendor— Affected 1.0.0 to before 2.1.0 Fixed in 2.1.0 Patch available GHSA-mjmq-gwgm-5qhm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:sshd:*:*:*:*:*:*:*:*1.0.0 to before 2.9.3VulnerableApache
  • cpe:2.3:a:apache:sshd:*:*:*:*:*:*:*:* Versions 1.0.0 to before 2.9.3 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache MINA SSHD (Apache Software Foundation) Fixed in 2.10
  • Fix · GHSA-mjmq-gwgm-5qhm org.apache.sshd:sshd-common (Maven) Fixed in 2.9.3 Advisory →
  • Fix · GHSA-mjmq-gwgm-5qhm org.apache.sshd:sshd-sftp (Maven) Fixed in 2.9.3 Advisory →
  • Fix · GHSA-mjmq-gwgm-5qhm org.apache.sshd:sshd-core (Maven) Fixed in 2.1.0 Advisory →

Red Hat 9 advisories

  • RHSA-2024:1194 Released 2024-03-06 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 8.0.1 security update
    • EAP 8.0.1
  • RHSA-2024:1192 Released 2024-03-06 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 8.0.1 security update
    • Red Hat JBoss EAP 8.0 for RHEL 8 eap8-apache-sshd-2.12.0-1.redhat_00001.1.el8eap, eap8-eclipse-jgit-6.6.1.202309021850-1.r_redhat_00001.1.el8eap, eap8-log4j-2.19.0-2.redhat_00001.1.el8eap +12
  • RHSA-2024:1193 Released 2024-03-06 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 8.0.1 security update
    • Red Hat JBoss EAP 8.0 for RHEL 9 eap8-apache-sshd-2.12.0-1.redhat_00001.1.el9eap, eap8-eclipse-jgit-6.6.1.202309021850-1.r_redhat_00001.1.el9eap, eap8-log4j-2.19.0-2.redhat_00001.1.el9eap +12
Show 6 more Red Hat advisories
  • RHSA-2023:7700 Released 2023-12-07 · Red Hat rating Important
    Red Hat build of Quarkus 2.13.9 release and security update
    • Red Hat build of Quarkus 2.13.9
  • RHSA-2023:7638 Released 2023-12-04 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 8 security update
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-2.16.0-17.redhat_00051.1.el8eap, eap7-activemq-artemis-cli-2.16.0-17.redhat_00051.1.el8eap, eap7-activemq-artemis-commons-2.16.0-17.redhat_00051.1.el8eap +47
  • RHSA-2023:7641 Released 2023-12-04 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.14 security update
    • Red Hat JBoss Enterprise Application Platform com.google.guava.guava-32.1.1.jre-redhat-00001.jar, io.netty.netty-codec-http2-4.1.94.Final-redhat-00003.jar, io.undertow.undertow-core-2.2.28.SP1-redhat-00001.jar +4
  • RHSA-2023:7637 Released 2023-12-04 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 7 security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-2.16.0-17.redhat_00051.1.el7eap, eap7-activemq-artemis-cli-2.16.0-17.redhat_00051.1.el7eap, eap7-activemq-artemis-commons-2.16.0-17.redhat_00051.1.el7eap +47
  • RHSA-2023:7639 Released 2023-12-04 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 9 security update
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-activemq-artemis-2.16.0-17.redhat_00051.1.el9eap, eap7-activemq-artemis-cli-2.16.0-17.redhat_00051.1.el9eap, eap7-activemq-artemis-commons-2.16.0-17.redhat_00051.1.el9eap +47
  • RHSA-2023:5396 Released 2023-09-28 · Red Hat rating Moderate
    Red Hat Data Grid 8.4.4 security update
    • Red Hat Data Grid 8.4.4

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix planned: Out of support scope
OpenShift ServerlessAffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat Integration Camel Quarkus 2AffectedNo fix yet
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Out of support scope
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat Virtualization 4AffectedNo fix planned: Out of support scope
EAP 8.0.1Fixed RHSA-2024:1194
Red Hat Data Grid 8.4.4Fixed RHSA-2023:5396
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2023:7637
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2023:7638
Red Hat JBoss EAP 7.4 for RHEL 9Fixed RHSA-2023:7639
Red Hat JBoss EAP 8.0 for RHEL 8Fixed RHSA-2024:1192
Red Hat JBoss EAP 8.0 for RHEL 9Fixed RHSA-2024:1193
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2023:7641
Red Hat build of Quarkus 2.13.9Fixed RHSA-2023:7700
Not affected: 5 products
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss EAP 7.4 for RHEL 9
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat support for Spring Boot

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-35887
  2. 2026-10-03 Alias added: GHSA-mjmq-gwgm-5qhm
  3. 2026-10-09 Fix available: Red Hat build of Quarkus 2.13.9 · Red Hat

References

Advisory 2

Other 6

  • TI-2022-22144 Apache MINA SSHD: Java unsafe deserialization vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2021-10677 DoS/OOM leak vulnerability in Apache Mina SSHD Server CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences