CVE Vulnerabilities

CVE-2022-45047

Deserialization of Untrusted Data

Published: Nov 16, 2022 | Modified: Nov 21, 2024
CVSS 3.x
9.8
CRITICAL
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
9.8 IMPORTANT
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Ubuntu

Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server.

Weakness

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected Software

Name Vendor Start Version End Version
Sshd Apache * 2.9.1 (including)
OCP-Tools-4.12-RHEL-8 RedHat jenkins-2-plugins-0:4.12.1675702407-1.el8 *
OpenShift Developer Tools and Services for OCP 4.11 RedHat jenkins-2-plugins-0:4.11.1683009941-1.el8 *
Red Hat build of Quarkus RedHat *
Red Hat build of Quarkus Platform 2.7.6.SP3 RedHat sshd-common *
Red Hat Data Grid 8.4.1 RedHat mina-sshd *
Red Hat Data Grid 8.4.4 RedHat *
Red Hat JBoss Enterprise Application Platform 7 RedHat sshd-common *
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 RedHat eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7 *
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 RedHat eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7 *
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 RedHat eap7-jettison-0:1.3.8-2.redhat_00002.1.ep7.el7 *
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 RedHat eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7 *
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 RedHat eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7 *
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 RedHat eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el7 *
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 RedHat eap7-velocity-0:1.7.0-3.redhat_00006.1.ep7.el7 *
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 RedHat eap7-wildfly-0:7.1.9-2.GA_redhat_00002.1.ep7.el7 *
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 RedHat eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 RedHat eap7-jackson-annotations-0:2.10.4-2.redhat_00004.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 RedHat eap7-jackson-core-0:2.10.4-2.redhat_00004.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 RedHat eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 RedHat eap7-jackson-jaxrs-providers-0:2.10.4-2.redhat_00004.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 RedHat eap7-jackson-modules-base-0:2.10.4-4.redhat_00004.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 RedHat eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 RedHat eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 RedHat eap7-netty-0:4.1.63-4.Final_redhat_00002.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 RedHat eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 RedHat eap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 RedHat eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 RedHat eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el8eap *
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 RedHat eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap *
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 RedHat eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap *
Red Hat OpenShift Container Platform 4.10 RedHat jenkins-2-plugins-0:4.10.1675144701-1.el8 *
Red Hat OpenShift Container Platform 4.9 RedHat jenkins-2-plugins-0:4.9.1675668922-1.el8 *
Red Hat Single Sign-On 7 RedHat sshd-common *
Red Hat Single Sign-On 7.6 for RHEL 7 RedHat rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso *
Red Hat Single Sign-On 7.6 for RHEL 8 RedHat rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso *
Red Hat Single Sign-On 7.6 for RHEL 9 RedHat rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso *
Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 RedHat vdsm-0:4.50.3.6-1.el8ev *
Red Hat Virtualization Engine 4.4 RedHat apache-sshd-1:2.9.2-0.1.el8ev *
RHEL-8 based Middleware Containers RedHat rh-sso-7/sso76-openshift-rhel8:7.6-20 *
RHINT Camel-Springboot 3.18.3.P2 RedHat *
RHPAM 7.13.4 async RedHat mina-sshd *

Potential Mitigations

  • Make fields transient to protect them from deserialization.
  • An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.

References