Source: mina2 Version: 2.2.1-4 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for mina2. CVE-2026-56452[0]: | Path traversal in the sshd-scp component of Apache MINA SSHD. Apache | MINA SSHD is a Java library for client-side and server-side SSH. | The implementation of receiving files or directories via SCP did not | validate filenames in SCP "C" or "D" commands. A malicious sender | could send filenames containing paths, resulting in files to be | written in attacker-controlled places. The issue affects only | * applications that use no longer supported Apache MINA SSHD | versions < 2.0.0 and use the SCP functions to receive files, * or | applications using sshd-scp in Apache MINA SSHD >= 2.0.0 to receive | files. Applications using Apache MINA SSHD >= 2.0.0 not using | sshd-scp are not affected. The issue is fixed in Apache MINA | 2.19.0 and 3.0.0-M5. Affected applications are advised to upgrade to | these versions. CVE-2026-56624[1]: | Improper certificate validation in Apache MINA SSHD (server- | side). Apache MINA SSHD is a Java library for client-side and | server-side SSH. Server-side OpenSSH user certificate validation | during user authentication in an Apache MINA SSHD server did not | check for the unsupported force-command or verify-required options | that could be embedded in the certificate, nor did it validate these | options. As a result it was possible that a user could authenticate | with such a certificate that included a force-command option but | still was able to execute other commands. What other command exactly | would be available to the user depends on the implementation of the | server. This issue is fixed in Apache MINA SSHD 2.19.0 and | 3.0.0-M5. Applications are advised to upgrade to these versions. | The fix rejects OpenSSH user certificates that include these | options, since Apache MINA SSHD implements neither force-command nor | sk-*[email protected] user certificates (which are the only ones | for which verify-required would make sense). CVE-2026-58624[2]: | Improper input validation in sshd-git in Apache MINA SSHD. Apache | MINA SSHD is a Java library for client-side and server-side SSH. | Component org.apache.sshd:sshd-git provides though its | GitPgmCommandFactory a way to configure an Apache MINA SSHD server | such that SSH clients can remotely execute git commands via the JGit | library on git repositories stored on the server. This | GitPgmCommandFactory allowed a user authenticated via SSH to run any | JGit command available, including commands that could write files at | arbitrary places such as git archive with the --output option. | Affected are SSH servers implemented with Apache MINA SSHD and using | the GitPgmCommandFactory. If the GitPgmCommandFactory is not | configured on the server, the server is not affected. It is | recommended to upgrade affected servers to Apache MINA SSHD 2.19.0 | or 3.0.0-M5, which fix this issue. The issue is fixed by | restricting the available commands to a small whitelist of | uncritical commands (such as git log). git archive is also allowed, | but its --output argument is ignored and the archive is always sent | through the SSH channel to the client. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-56452 https://www.cve.org/CVERecord?id=CVE-2026-56452 [1] https://security-tracker.debian.org/tracker/CVE-2026-56624 https://www.cve.org/CVERecord?id=CVE-2026-56624 [2] https://security-tracker.debian.org/tracker/CVE-2026-58624 https://www.cve.org/CVERecord?id=CVE-2026-58624 Regards, Salvatore __ This is the maintainer address of Debian's Java team <https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-java-maintainers>. Please use [email protected] for discussions and questions.
