AI analysis
Apache MINA SSHD’s sshd-scp component reads SCP protocol lines without any length limit. A malicious peer that has low privileges can send a junk SCP command of characters that never includes a line feed, so the receiver keeps allocating memory until the process crashes with an OutOfMemoryError. Impact is denial of service only (high availability impact, no confidentiality or integrity loss); CVSS 3.1 scores it 6.5 and requires network access with low privileges and no user interaction. Java applications that embed Apache MINA SSHD through 2.19.0, or the 3.0.0-M1 through 3.0.0-M5 milestones, and that use the SCP implementation are affected. No public proof of concept is known and the issue is not in CISA KEV.
What to do: Upgrade Apache MINA SSHD to 2.20.0 or 3.0.0-M6, which enforce an upper limit on SCP protocol line length. Inventory Java applications that bundle older MINA SSHD and use the SCP implementation, then replace those libraries and restart the affected services.
Affected
| Apache MINA SSHD (sshd-scp) | up to 2.19.0, and 3.0.0-M1 through 3.0.0-M5 |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP command protocol is line-oriented with LF-terminated lines. The protocol handler in sshd-scp did not impose any limit on the length of such protocol lines. A malicious peer just sending a junk command containing a never-ending sequence of characters but never a LF would cause the receiver to allocate memory to store this whole junk command, exhausting memory and crashing the application with an OutOfMemoryError. Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue by enforcing an upper limit on the length of SCP protocol lines.