This is an automated email from the ASF dual-hosted git repository.
Kusuma04-dev pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/incubator-kie.git
The following commit(s) were added to refs/heads/main by this push:
new 6346ab93a92 [NO-ISSUE] : CVE-2026-56624: upgrade Apache MINA SSHD
(sshd-common/sshd-core) to 2… (#6873)
6346ab93a92 is described below
commit 6346ab93a92d7eeb5eb3d77f75f8fe582dbf5d3c
Author: athirakm94 <[email protected]>
AuthorDate: Tue Aug 11 11:42:03 2026 +0530
[NO-ISSUE] : CVE-2026-56624: upgrade Apache MINA SSHD
(sshd-common/sshd-core) to 2… (#6873)
* CVE-2026-56624: upgrade Apache MINA SSHD (sshd-common/sshd-core) to 2.19.0
quarkus-bom:3.27.4.1 (via wildfly-elytron-parent:2.6.5.Final) hard-pins
org.apache.sshd:sshd-common and org.apache.sshd:sshd-core to 2.12.1.
No newer Quarkus BOM version is available that resolves this transitively,
so explicit dependencyManagement overrides are added to the three
build-parent/BOM files that directly import quarkus-bom.
Files modified:
- kie-quarkus-build-parent/pom.xml
- kogito-quarkus/bom/pom.xml
- optaplanner-build/optaplanner-build-parent/pom.xml
* Remove redundant SSHD BOM overrides
* Keep SSHD override only in Kogito Quarkus BOM
* Centralize SSHD version management in kie-parent
---
kie-parent/pom.xml | 12 ++++++++++++
optaplanner-build/optaplanner-build-parent/pom.xml | 13 +++++++++++++
2 files changed, 25 insertions(+)
diff --git a/kie-parent/pom.xml b/kie-parent/pom.xml
index c3b45a02cb2..6ea551db3fe 100644
--- a/kie-parent/pom.xml
+++ b/kie-parent/pom.xml
@@ -228,6 +228,8 @@
This managed entry forces 2.26.1 across all modules inheriting
kie-parent.
https://logging.apache.org/security.html#CVE-2026-49844 -->
<version.org.apache.logging.log4j>2.26.1</version.org.apache.logging.log4j>
+ <!-- CVE-2026-56624: Apache MINA SSHD fixed version -->
+ <version.org.apache.sshd>2.19.0</version.org.apache.sshd>
<version.org.apache.maven>3.9.11</version.org.apache.maven>
<version.org.apache.maven.resolver>1.7.3</version.org.apache.maven.resolver>
<version.org.apache.maven.wagon>3.5.3</version.org.apache.maven.wagon>
@@ -1848,6 +1850,16 @@
<artifactId>infinispan-server-testdriver-core</artifactId>
<version>${version.org.infinispan}</version>
</dependency>
+ <dependency>
+ <groupId>org.apache.sshd</groupId>
+ <artifactId>sshd-common</artifactId>
+ <version>${version.org.apache.sshd}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.sshd</groupId>
+ <artifactId>sshd-core</artifactId>
+ <version>${version.org.apache.sshd}</version>
+ </dependency>
<dependency>
<groupId>org.infinispan.protostream</groupId>
<artifactId>protostream</artifactId>
diff --git a/optaplanner-build/optaplanner-build-parent/pom.xml
b/optaplanner-build/optaplanner-build-parent/pom.xml
index 2d7ecfd1f9b..df11b380c81 100644
--- a/optaplanner-build/optaplanner-build-parent/pom.xml
+++ b/optaplanner-build/optaplanner-build-parent/pom.xml
@@ -62,6 +62,8 @@
<version.org.openrewrite.recipe>1.19.3</version.org.openrewrite.recipe>
<version.org.slf4j>2.0.17</version.org.slf4j><!-- TODO keep in sync with
quarkus-bom -->
<version.org.eclipse.parsson>1.1.8</version.org.eclipse.parsson>
+ <!-- CVE-2026-56624: Apache MINA SSHD fixed version -->
+ <version.org.apache.sshd>2.19.0</version.org.apache.sshd>
<version.org.springframework>7.0.8</version.org.springframework>
<version.org.springframework.boot>4.0.7</version.org.springframework.boot>
<version.com.fasterxml.jackson.databind>2.22.1</version.com.fasterxml.jackson.databind>
@@ -141,6 +143,17 @@
<scope>import</scope>
</dependency>
<!-- Normal dependencies versions-->
+ <!-- CVE-2026-56624: override sshd-common and sshd-core pinned at 2.12.1
by quarkus-bom -->
+ <dependency>
+ <groupId>org.apache.sshd</groupId>
+ <artifactId>sshd-common</artifactId>
+ <version>${version.org.apache.sshd}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.sshd</groupId>
+ <artifactId>sshd-core</artifactId>
+ <version>${version.org.apache.sshd}</version>
+ </dependency>
<!-- CVE fix: override micrometer version brought in by quarkus-bom
3.27.4 (1.14.7) to 1.16.6 -->
<dependency>
<groupId>io.micrometer</groupId>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
