CVE-2022-45047

Apache MINA SSHD: Java unsafe deserialization vulnerability

Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server.

Affected

Apache Software Foundation · Apache MINA SSHD

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

3.79% chance of exploitation in the next 30 days, 90th percentile

Published

2022-11-16

Updated

2026-05-01

Proof-of-concept exploits (1)

• hktalent/CVE-2022-450472★ · 2023-04-07

Security advisories

• advisories/GHSA-fhw8-8j55-vwgq

References

• CVE Record
• NVD entry

Related

• CVE-2020-2546
• CVE-2020-2551
• CVE-2021-40865
• CVE-2022-21306
• CVE-2022-21350
• CVE-2022-22963