Deserialization of Untrusted Data in Apache Mina SSHD - CVE-2022-45047

Vulnerability identifier: #VU70530

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-45047

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data within the org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider class. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Apache Mina SSHD
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Enterprise Storage
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Development Tools Module
openSUSE Leap
openEuler
DB2 Data Management Console
IBM Business Automation Manager Open Editions
Oracle Business Intelligence Enterprise Edition
Oracle FLEXCUBE Universal Banking
Dell Data Protection Central
Red Hat Virtualization Manager
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Tivoli Netcool Impact
Oracle Communications Session Report Manager
Oracle Enterprise Data Quality
Middleware Common Libraries and Tools
Enterprise Manager Base Platform
Oracle Banking Trade Finance
Oracle Banking Treasury Management
Management Cloud Engine
Oracle Communications Cloud Native Core Automated Test Suite
Red Hat build of Quarkus
Red Hat OpenShift Container Platform
OSS Support Tools
OpenShift Developer Tools and Services
Red Hat Camel for Spring Boot
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
Oracle Banking Corporate Lending
JBoss Enterprise Application Platform
Oracle Coherence
Red Hat Single Sign-On
JBoss Data Grid
PeopleSoft Enterprise PeopleTools
Oracle Communications Element Manager
Oracle Managed File Transfer
Oracle Business Process Management Suite
Oracle Global Lifecycle Management NextGen OUI Framework
Oracle Banking Payments
Oracle Retail Customer Management and Segmentation Foundation
eap7-jboss-jsp (Red Hat package)
eap7-jboss-jsf (Red Hat package)
eap7-javaee-security-soteria (Red Hat package)
rhv-log-collector-analyzer (Red Hat package)
ovirt-engine-ui-extensions (Red Hat package)
eap7-jettison (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-velocity (Red Hat package)
ovirt-web-ui (Red Hat package)
eap7-elytron-web (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
cri-o (Red Hat package)
eap7-snakeyaml (Red Hat package)
eap7-undertow (Red Hat package)
eap7-jackson-databind (Red Hat package)
apache-sshd (Red Hat package)
apache-sshd-javadoc
apache-sshd
eap7-apache-sshd (Red Hat package)
eap7-jackson-jaxrs-providers (Red Hat package)
eap7-jackson-modules-java8 (Red Hat package)
eap7-jackson-annotations (Red Hat package)
eap7-jackson-core (Red Hat package)
eap7-jackson-modules-base (Red Hat package)
jenkins (Red Hat package)
eap7-resteasy (Red Hat package)
eap7-apache-cxf (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
eap7-netty (Red Hat package)
ovirt-engine (Red Hat package)
jenkins-2-plugins (Red Hat package)
vdsm (Red Hat package)
eap7-jboss-remoting (Red Hat package)
eap7-hibernate-search (Red Hat package)
eap7-woodstox-core (Red Hat package)
eap7-wildfly (Red Hat package)
rh-sso7-keycloak (Red Hat package)
apache-parent
IBM Spectrum Scale

Install updates from vendor's website.

Apache Mina SSHD - update to 2.9.2
DB2 Data Management Console - update to 3.1.13
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.3
Red Hat OpenShift Container Platform - addressed in versions 4.9.56, 4.10.51
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.13.4
IBM Tivoli Netcool Impact - update to 7.1.0.28
JBoss Enterprise Application Platform - addressed in versions 7.1.9, 7.3.12, 7.4.9
Red Hat Single Sign-On - update to 7.6.2
IBM Business Automation Manager Open Editions - update to 8.0.3
JBoss Data Grid - addressed in versions 8.4.1, 8.4.4
Oracle Global Lifecycle Management NextGen OUI Framework - update to 13.9.4.2.11
Oracle Banking Corporate Lending - update to 14.4
Oracle FLEXCUBE Universal Banking - update to 14.7.0.0.0
Oracle Banking Trade Finance - update to 14.4
eap7-jboss-jsp (Red Hat package) - addressed in versions api_2.3_spec-2.0.0-3.Final_redhat_00001.1.el7eap, api_2.3_spec-2.0.0-3.Final_redhat_00001.1.el8eap, api_2.3_spec-2.0.0-3.Final_redhat_00001.1.el9eap
eap7-jboss-jsf (Red Hat package) - addressed in versions api_2.3_spec-3.0.0-6.SP07_redhat_00001.1.el7eap, api_2.3_spec-3.0.0-6.SP07_redhat_00001.1.el8eap, api_2.3_spec-3.0.0-6.SP07_redhat_00001.1.el9eap
eap7-javaee-security-soteria (Red Hat package) - addressed in versions 1.0.1-3.redhat_00003.1.el7eap, 1.0.1-3.redhat_00003.1.el8eap, 1.0.1-3.redhat_00003.1.el9eap
rhv-log-collector-analyzer (Red Hat package) - update to 1.0.16-1.el8ev
ovirt-engine-ui-extensions (Red Hat package) - update to 1.3.7-1.el8ev
eap7-jettison (Red Hat package) - addressed in versions 1.3.8-2.redhat_00002.1.ep7.el7, 1.5.2-1.redhat_00002.1.el7eap, 1.5.2-1.redhat_00002.1.el8eap, 1.5.2-1.redhat_00002.1.el9eap, 1.5.2-2.redhat_00002.1.el7eap
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.10-1.Final_redhat_00001.1.el7eap, 1.5.10-1.Final_redhat_00001.1.el8eap, 1.5.10-1.Final_redhat_00001.1.el9eap
eap7-velocity (Red Hat package) - update to 1.7.0-3.redhat_00006.1.ep7.el7
ovirt-web-ui (Red Hat package) - update to 1.9.3-1.el8ev
eap7-elytron-web (Red Hat package) - addressed in versions 1.9.3-1.Final_redhat_00001.1.el7eap, 1.9.3-1.Final_redhat_00001.1.el8eap, 1.9.3-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-24.Final_redhat_00023.1.el7eap, 1.10.0-24.Final_redhat_00023.1.el8eap, 1.10.0-24.Final_redhat_00023.1.el9eap
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.16-1.Final_redhat_00001.1.el7eap, 1.15.16-1.Final_redhat_00001.1.el8eap, 1.15.16-1.Final_redhat_00001.1.el9eap
cri-o (Red Hat package) - addressed in versions 1.23.5-5.rhaos4.10.gitd9dec98.el7, 1.23.5-5.rhaos4.10.gitd9dec98.el8
eap7-snakeyaml (Red Hat package) - addressed in versions 1.33.0-1.SP1_redhat_00001.1.el7eap, 1.33.0-1.SP1_redhat_00001.1.ep7.el7
eap7-undertow (Red Hat package) - addressed in versions 2.2.22-1.SP3_redhat_00001.1.el7eap, 2.2.22-1.SP3_redhat_00001.1.el8eap, 2.2.22-1.SP3_redhat_00001.1.el9eap
eap7-jackson-databind (Red Hat package) - addressed in versions 2.8.11.6-2.SP1_redhat_00002.1.ep7.el7, 2.10.4-4.redhat_00004.1.el7eap, 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
apache-sshd (Red Hat package) - update to 2.9.2-0.1.el8ev
apache-sshd-javadoc - update to 2.9.2-1
apache-sshd - update to 2.9.2-1
eap7-apache-sshd (Red Hat package) - addressed in versions 2.9.2-1.redhat_00001.1.el7eap, 2.9.2-1.redhat_00001.1.el8eap, 2.9.2-1.redhat_00001.1.el9eap
eap7-jackson-jaxrs-providers (Red Hat package) - addressed in versions 2.10.4-2.redhat_00004.1.el7eap, 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-modules-java8 (Red Hat package) - addressed in versions 2.10.4-2.redhat_00004.1.el7eap, 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-annotations (Red Hat package) - addressed in versions 2.10.4-2.redhat_00004.1.el7eap, 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-core (Red Hat package) - addressed in versions 2.10.4-2.redhat_00004.1.el7eap, 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
eap7-jackson-modules-base (Red Hat package) - addressed in versions 2.10.4-4.redhat_00004.1.el7eap, 2.12.7-1.redhat_00003.1.el7eap, 2.12.7-1.redhat_00003.1.el8eap, 2.12.7-1.redhat_00003.1.el9eap
apache-sshd-javadoc - update to 2.12.0-150200.5.8.1
apache-sshd - update to 2.12.0-150200.5.8.1
Red Hat build of Quarkus - update to 2.13.7
jenkins (Red Hat package) - addressed in versions 2.361.1.1675668150-1.el8, 2.361.4.1675702346-3.el8, 2.387.1.1683009763-3.el8, 2.414.3.1698293911-3.el8
eap7-resteasy (Red Hat package) - addressed in versions 3.0.27-1.Final_redhat_00001.1.ep7.el7, 3.11.6-1.Final_redhat_00001.1.el7eap
eap7-apache-cxf (Red Hat package) - update to 3.1.16-4.redhat_00003.1.ep7.el7
eap7-hal-console (Red Hat package) - addressed in versions 3.2.17-1.Final_redhat_00001.1.el7eap, 3.3.16-1.Final_redhat_00001.1.el7eap, 3.3.16-1.Final_redhat_00001.1.el8eap, 3.3.16-1.Final_redhat_00001.1.el9eap
Red Hat Camel for Spring Boot - update to 3.18.3 Patch 2
eap7-jboss-ejb-client (Red Hat package) - addressed in versions 4.0.49-1.Final_redhat_00001.1.el7eap, 4.0.49-1.Final_redhat_00001.1.el8eap, 4.0.49-1.Final_redhat_00001.1.el9eap
eap7-netty (Red Hat package) - addressed in versions 4.1.63-1.Final_redhat_00002.1.ep7.el7, 4.1.63-4.Final_redhat_00002.1.el7eap
ovirt-engine (Red Hat package) - update to 4.5.3.5-1.el8ev
jenkins-2-plugins (Red Hat package) - addressed in versions 4.9.1675668922-1.el8, 4.10.1675144701-1.el8, 4.11.1683009941-1.el8, 4.12.1675702407-1.el8, 4.12.1698294000-1.el8
vdsm (Red Hat package) - update to 4.50.3.6-1.el8ev
eap7-jboss-remoting (Red Hat package) - addressed in versions 5.0.27-1.Final_redhat_00001.1.el7eap, 5.0.27-1.Final_redhat_00001.1.el8eap, 5.0.27-1.Final_redhat_00001.1.el9eap
IBM Spectrum Scale - addressed in versions 5.1.2.9, 5.1.7.0
eap7-hibernate-search (Red Hat package) - addressed in versions 5.10.13-3.Final_redhat_00001.1.el7eap, 5.10.13-3.Final_redhat_00001.1.el8eap, 5.10.13-3.Final_redhat_00001.1.el9eap
eap7-woodstox-core (Red Hat package) - addressed in versions 6.4.0-1.redhat_00001.1.el7eap, 6.4.0-1.redhat_00001.1.el8eap, 6.4.0-1.redhat_00001.1.el9eap
eap7-wildfly (Red Hat package) - addressed in versions 7.1.9-2.GA_redhat_00002.1.ep7.el7, 7.3.12-3.GA_redhat_00002.1.el7eap, 7.4.9-4.GA_redhat_00003.1.el7eap, 7.4.9-4.GA_redhat_00003.1.el8eap, 7.4.9-4.GA_redhat_00003.1.el9eap
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.6-1.redhat_00001.1.el7sso, 18.0.6-1.redhat_00001.1.el8sso, 18.0.6-1.redhat_00001.1.el9sso
Dell Data Protection Central - update to 19.11.0-2
apache-parent - update to 31-150200.3.12.1

• Exploit #8966 - CVE-2022-45047 (POC,EXP,chatGPT for me) (April 7, 2023)

• https://www.mail-archive.com/dev@mina.apache.org/msg39312.html

• Remote code execution in Apache MINA SSHD
• Deserialization of untrusted data in IBM Tivoli Netcool Impact
• Multiple vulnerabilities in Red Hat Virtualization Manager 4.4
• Multiple vulnerabilities in Oracle Global Lifecycle Management NextGen OUI Framework
• Multiple vulnerabilities in Oracle Coherence
• Multiple vulnerabilities in Middleware Common Libraries and Tools
• Multiple vulnerabilities in OSS Support Tools
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 7
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in OpenShift Container Platform 4.10
• Multiple vulnerabilities in Red Hat Data Grid
• Multiple vulnerabilities in Red Hat build of Quarkus
• Multiple vulnerabilities in OpenShift Container Platform 4.9
• Multiple vulnerabilities in OpenShift Container Platform 4.9
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for OpenShift
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 9
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 8
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 7
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• OpenShift Developer Tools and Services for OCP 4.12 update for Jenkins and Jenkins-2-plugins
• Multiple vulnerabilities in Oracle Business Process Management Suite
• Multiple vulnerabilities in Oracle Communications Session Report Manager
• Multiple vulnerabilities in Oracle Communications Element Manager
• Multiple vulnerabilities in Management Cloud Engine
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Automated Test Suite
• Multiple vulnerabilities in Oracle Retail Customer Management and Segmentation Foundation
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• OpenShift Developer Tools and Services for OCP 4.11 update for jenkins and jenkins-2-plugins
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in Red Hat Integration Camel for Spring Boot
• Deserialization of untrusted data in IBM Spectrum Scale
• Multiple vulnerabilities in Oracle Enterprise Data Quality
• Multiple vulnerabilities in Red Hat Process Automation Manager
• Multiple vulnerabilities in Red Hat Data Grid 8.4
• Red Hat Product OCP Tools 4.12 update for Openshift Jenkins
• SUSE update for apache-parent, apache-sshd
• openEuler update for apache-sshd
• Multiple vulnerabilities in Dell Data Protection Central
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7
• Multiple vulnerabilities in Enterprise Manager Base Platform
• Multiple vulnerabilities in IBM Knowledge Catalog for IBM Cloud Pak for Data
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in Oracle Banking Payments
• Multiple vulnerabilities in Oracle FLEXCUBE Universal Banking
• Multiple vulnerabilities in Oracle Banking Treasury Management
• Multiple vulnerabilities in Oracle Banking Corporate Lending
• Multiple vulnerabilities in Oracle Banking Trade Finance
• Multiple vulnerabilities in IBM DB2 Data Management Console
• Multiple vulnerabilities in Oracle Managed File Transfer