Medium severity · published Jul 12, 2021
CVE-2021-30129
A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error
6.5
CVSS
3%
EPSS
No
On KEV
Description
A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache Mina SSHD 2.7.0
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BP
Banking Payments · Oracle
14.5 · source: NVD
BT
Banking Trade Finance · Oracle
14.5 · source: NVD
BT
Banking Treasury Management · Oracle
14.5 · source: NVD
CC
Communications Cloud Native Core Console · Oracle
1.9.0 · source: NVD
FU
Flexcube Universal Banking · Oracle
14.0.0 through 14.3.0; 14.5 · source: NVD
MC
Middleware Common Libraries And Tools · Oracle
12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0 · source: NVD
OS
Oss Support Tools · Oracle
2.12.42 · source: NVD
RC
Retail Customer Management And Segmentation Foundation · Oracle
18.0; 19.0 · source: NVD
SS
Sshd · Apache
2.0.0 before 2.7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-30129
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-30129
Mailing List
http://www.openwall.com/lists/oss-security/2021/07/12/1
Mailing List
https://lists.apache.org/thread.html/r6d4f78e192a0c8eabd671a018da464024642980ecd24096bde6db36f%40%3Cusers.mina.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/red01829efa2a8c893c4baff4f23c9312bd938543a9b8658e172b853b%40%3Cannounce.apache.org%3E
Patch
https://www.oracle.com/security-alerts/cpuapr2022.html
www.oracle.com
https://www.oracle.com/security-alerts/cpujul2022.html
More from Sshd
9.8
CVE-2022-45047
Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey
5.9
CVE-2023-48795
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some…
4.3
CVE-2023-35887
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA