Severity: important


Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in 
Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized The class is one of several implementations that an 
implementor using Apache MINA SSHD can choose for loading the host keys of an 
SSH server.


For Apache MINA SSHD <= 2.9.1, do not use 
org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to generate 
and later load your server's host key. Use separately generated host key files, 
for instance in OpenSSH format, and load them via a 
org.apache.sshd.common.keyprovider.FileKeyPairProvider instead. Or use a custom 
implementation instead of SimpleGeneratorHostKeyProvider that uses the OpenSSH 
format for storing and loading the host key (via classes 
OpenSSHKeyPairResourceWriter and OpenSSHKeyPairResourceParser).

The issue was fixed in Apache MINA SSHD 2.9.2. 


The Apache MINA SSHD team would like to thank Zhang Zewei, NOFOCUS, for 
reporting this issue.

To unsubscribe, e-mail:
For additional commands, e-mail:

Reply via email to