Apache MINA SSHD: integrity check bypass
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 1 fixed, 9 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.
Summary
Like many other SSH implementations, Apache MINA SSHD suffered from the issue that is more widely known as CVE-2023-48795. An attacker that can intercept traffic between client and server could drop certain packets from the stream, potentially causing client and server to consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack The mitigations to prevent this type of attack were implemented in Apache MINA SSHD 2.12.0, both client and server side. Users are recommended to upgrade to at least this version. Note that both the client and the server implementation must have mitigations applied against this issue, otherwise the connection may still be affected.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache MINA SSHD | up to 2.11.0 | — | No fix listed | CNA |
| — | org.apache.sshd:sshd-common (Maven) | before 2.12.0 | 2.12.0 | Patch available | GHSA-2326-hx7g-3m9r |
- Apache MINA SSHD VendorApache Affected up to 2.11.0 Fixed in — No fix listed CNA
- org.apache.sshd:sshd-common (Maven) Vendor— Affected before 2.12.0 Fixed in 2.12.0 Patch available GHSA-2326-hx7g-3m9r
Remediation
- Fix · GHSA-2326-hx7g-3m9r org.apache.sshd:sshd-common (Maven) Fixed in 2.12.0 Advisory →
Red Hat 1 advisory
- RHSA-2024:1194 Released 2024-03-06 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 8.0.1 security update
- EAP 8.0.1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| A-MQ Clients 2 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Will not fix |
| Red Hat Process Automation 7 | Affected | No fix planned: Will not fix |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Will not fix |
| Red Hat Virtualization 4 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel for Spring Boot 3 | Affected | No fix planned: Will not fix |
| EAP 8.0.1 | Fixed | RHSA-2024:1194 |
Not affected: 10 products
- OpenShift Developer Tools and Services
- Red Hat Data Grid 8
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat JBoss Web Server 6
- Red Hat build of Apache Camel - HawtIO 4
- Red Hat build of Apache Camel 4 for Quarkus 3
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat build of Quarkus
Timeline
- 2026-10-02 Threatist record created from CVE-2024-41909
- 2026-10-03 Alias added: GHSA-2326-hx7g-3m9r
References
Advisory 2
Other 8
- https://github.com/apache/mina-sshd/issues/445
- https://github.com/apache/mina-sshd/pull/449
- https://github.com/apache/mina-sshd/commit/315739e4e9d1dc7a4ff32ea64936982ed0b73e76
- https://github.com/apache/mina-sshd/commit/6b0fd46f64bcb75eeeee31d65f10242660aad7c1
- https://github.com/apache/mina-sshd/commit/7b2c781640a7a78a9455b86593a1f63c9e8cab92
- https://github.com/apache/mina-sshd
- https://github.com/apache/mina-sshd/releases/tag/sshd-2.12.0
- https://security.netapp.com/advisory/ntap-20241011-0006
More Apache Mina Sshd vulnerabilities
- TI-2019-04327 An issue was discovered in OpenSSH 7.9. CVSS 3.1MEDIUM 5.9
- TI-2026-40791 Apache MINA SSHD: Path traversal in SCP file reception CVSS 3.1HIGH 7.5
- TI-2026-40830 Apache MINA SSHD: SSH certificate options lack validations CVSS 3.1HIGH 7.3
- TI-2026-40829 Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows CVSS 3.1HIGH 7.1
- TI-2026-36095 Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git CVSS 3.1HIGH 7.1
- TI-2026-42194 Apache MINA SSHD: Remote execution of JGit commands can write files on the server CVSS 3.1MEDIUM 5.4
Sources
- CVE-2024-41909 · CVE Program
- CVE-2024-41909 · NVD
- FIRST EPSS
- GHSA-2326-hx7g-3m9r · GitHub Advisory Database · CC BY 4.0
- CVE-2024-41909 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences