AI analysis
Apache MINA SSHD is a Java library for SSH clients and servers. Its server component (sshd-core) can require multiple authentication methods, including two different public keys, but in versions through 2.19.0 and 3.0.0-M1 through 3.0.0-M5 it does not check that the two keys presented are distinct. A user who already holds one accepted key pair can satisfy a two-public-key policy by presenting that same key twice, which is a partial authentication bypass rather than access with no credentials. Only deployments that run MINA SSHD as a server with a multi-public-key requirement are affected. No public proof-of-concept is known, and the issue is not listed in CISA KEV.
What to do: Upgrade Apache MINA SSHD (sshd-core) to 2.20.0 or 3.0.0-M6. Until then, do not treat a two-public-key policy as a second factor: require a different second method (for example public key plus password or keyboard-interactive) and review servers for multi-public-key authentication settings.
Affected
| Apache MINA SSHD | through 2.19.0, and 3.0.0-M1 through 3.0.0-M5 |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods "publickey,publickey". Apache MINA SSHD provides an equivalent configuration mechanism. In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass. Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.