CVE-2024-41909

Like many other SSH implementations, Apache MINA SSHD suffered from the issue that is more widely known as CVE-2023-48795. An attacker that can intercept traffic between client and server could drop certain packets from the stream, potentially causing client and server to consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack The mitigations to prevent this type of attack were implemented in Apache MINA SSHD 2.12.0, both client and server side. Users are recommended to upgrade to at least this version. Note that both the client and the server implementation must have mitigations applied against this issue, otherwise the connection may still be affected.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/apache/mina-sshd/issues/445	Issue Tracking
https://lists.apache.org/thread/vwf1ot8wx1njyy8n19j5j2tcnjnozt3b	Mailing List Vendor Advisory
https://security.netapp.com/advisory/ntap-20241011-0006/

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:mina_sshd:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-08-12 16:15

Updated : 2025-03-27 16:15

NVD link : CVE-2024-41909

Mitre link : CVE-2024-41909

CVE.ORG link : CVE-2024-41909

JSON object : View

Products Affected

apache

mina_sshd

CWE

CWE-354

Improper Validation of Integrity Check Value

{"id": "CVE-2024-41909", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2024-08-12T16:15:15.533", "references": [{"url": "https://github.com/apache/mina-sshd/issues/445", "tags": ["Issue Tracking"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/vwf1ot8wx1njyy8n19j5j2tcnjnozt3b", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "https://security.netapp.com/advisory/ntap-20241011-0006/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-354"}]}], "descriptions": [{"lang": "en", "value": "Like many other SSH implementations, Apache MINA SSHD suffered from the issue that is more widely known as CVE-2023-48795. An attacker that can intercept traffic between client and server could drop certain packets from the stream, potentially causing client and server to consequently end up with a connection for which \nsome security features have been downgraded or disabled, aka a Terrapin \nattack\n\nThe mitigations to prevent this type of attack were implemented in Apache MINA SSHD 2.12.0, both client and server side. Users are recommended to upgrade to at least this version. Note that both the client and the server implementation must have mitigations applied against this issue, otherwise the connection may still be affected."}, {"lang": "es", "value": "Como muchas otras implementaciones de SSH, Apache MINA SSHD sufri\u00f3 el problema m\u00e1s conocido como CVE-2023-48795. Un atacante que pueda interceptar el tr\u00e1fico entre el cliente y el servidor podr\u00eda descartar ciertos paquetes de la transmisi\u00f3n, lo que podr\u00eda provocar que el cliente y el servidor terminen con una conexi\u00f3n en la que algunas funciones de seguridad se hayan degradado o desactivado, tambi\u00e9n conocido como un ataque Terrapin. Las mitigaciones para evitar esto. tipo de ataque fueron implementados en Apache MINA SSHD 2.12.0, tanto del lado del cliente como del servidor. Se recomienda a los usuarios actualizar al menos a esta versi\u00f3n. Tenga en cuenta que tanto la implementaci\u00f3n del cliente como del servidor deben tener mitigaciones aplicadas contra este problema; de lo contrario, la conexi\u00f3n a\u00fan puede verse afectada."}], "lastModified": "2025-03-27T16:15:26.870", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:mina_sshd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F6C877D-CDBB-4A97-AEDD-A4FDF46259D7", "versionEndIncluding": "2.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}