Apache Sshd vulnerabilities

4 CVEs affecting Apache Sshd, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-48795, published 2023-12-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-48795, published 2023-12-18. Medium severity, CVSS 5.9. EPSS: 93.5% chance of exploitation in the next 30 days. The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from…
CVE-2022-45047, published 2022-11-16. Critical severity, CVSS 9.8. EPSS: 3.8% chance of exploitation in the next 30 days. Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of…
CVE-2021-30129, published 2021-07-12. Medium severity, CVSS 6.5. EPSS: 3% chance of exploitation in the next 30 days. A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD…
CVE-2023-35887, published 2023-07-10. Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days. Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA. In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem,…