title: Apache MINA SSHD: Java unsafe deserialization vulnerability
description: Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server.
problem types: CWE-502 Deserialization of Untrusted Data
affected:
{
vendor: Apache Software Foundation
product: Apache MINA SSHD
versions:
version: unspecified, lessThanOrEqual: 2.9.1, status: affected, versionType: custom
}
metrics:
other: [
type: unknown
content: {'other': 'important'}
]
workarounds: For Apache MINA SSHD <= 2.9.1, do not use org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to generate and later load your server's host key. Use separately generated host key files, for instance in OpenSSH format, and load them via a org.apache.sshd.common.keyprovider.FileKeyPairProvider instead. Or use a custom implementation instead of SimpleGeneratorHostKeyProvider that uses the OpenSSH format for storing and loading the host key (via classes OpenSSHKeyPairResourceWriter and OpenSSHKeyPairResourceParser).