DoS/OOM leak vulnerability in Apache Mina SSHD Server (Apache Software Foundation Apache Mina SSHD)

CVE-2021-30129

MEDIUM 6.5

En bref

Source: NVD
EPSS: EPSS 3.05 % · centile 88 (2026-10-31)
État: PUBLISHED
Publiée: 2021-07-12 12:10 UTC
Mise à jour: 2024-08-03 22:24 UTC
Attribuée par: apache
Statut NVD: Modified

Rechercher sur…

Description

A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache Mina SSHD 2.7.0

Faiblesses (CWE)

CWE-772 — Ressource non libérée après sa durée de vie utile

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 4.0	AV:N/AC:L/Au:S/C:N/I:N/A:P	NVD · nvd@nist.gov (Primary)

Avis

GHSA-9279-7hph-r3xw — Buffer Overflow in Apache Mina SSHD

Références européennes

ENISA EUVD · EUVD-2021-1649
GCVE · GCVE-0-2021-30129

Avis du CERT-FR

CERTFR-2023-AVI-0012 — Multiples vulnérabilités dans IBM Sterling · cert.ssi.gouv.fr
CERTFR-2021-AVI-951 — Multiples vulnérabilités dans le noyau Linux de RedHat · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:apache:sshd:*:*:*:*:*:*:*:* ≥ 2.0.0 < 2.7.0
cpe:2.3:a:oracle:banking_payments:14.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_trade_finance:14.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_treasury_management:14.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:flexcube_universal_banking:*:*:*:*:*:*:*:* ≥ 14.0.0 ≤ 14.3.0
cpe:2.3:a:oracle:flexcube_universal_banking:14.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:14.1.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:oss_support_tools:2.12.42:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:*

Produits affectés

Produit	Versions
Apache Software Foundation · Apache Mina SSHD	affected 2.0.0 < Apache Mina SSHD*

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

🟡 DoS/OOM leak vulnerability in Apache Mina SSHD Server (Apache Software Foundation Apache Mina SSHD)