VulnerableCode Package Details - pkg:maven/org.apache.sshd/sshd-common@2.9.3

Search for packages

Vulnerability	Summary	Fixed by
VCID-r4e4-u4s6-63gc Aliases: CVE-2023-35887 GHSA-mjmq-gwgm-5qhm	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA. In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" information about items outside the rooted tree via paths including parent navigation ("..") beyond the root, or involving symlinks. This issue affects Apache MINA: from 1.0 before 2.10. Users are recommended to upgrade to 2.10	2.10.0 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-zxcy-vvmk-xbag Aliases: CVE-2024-41909 GHSA-2326-hx7g-3m9r	Apache MINA SSHD: integrity check bypass Like many other SSH implementations, Apache MINA SSHD suffered from the issue that is more widely known as CVE-2023-48795. An attacker that can intercept traffic between client and server could drop certain packets from the stream, potentially causing client and server to consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack The mitigations to prevent this type of attack were implemented in Apache MINA SSHD 2.12.0, both client and server side. Users are recommended to upgrade to at least this version. Note that both the client and the server implementation must have mitigations applied against this issue, otherwise the connection may still be affected.	2.12.0 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-r4e4-u4s6-63gc
Aliases:
CVE-2023-35887
GHSA-mjmq-gwgm-5qhm

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA. In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" information about items outside the rooted tree via paths including parent navigation ("..") beyond the root, or involving symlinks. This issue affects Apache MINA: from 1.0 before 2.10. Users are recommended to upgrade to 2.10

2.10.0
Affected by 1 other vulnerability.

VCID-zxcy-vvmk-xbag
Aliases:
CVE-2024-41909
GHSA-2326-hx7g-3m9r

Apache MINA SSHD: integrity check bypass Like many other SSH implementations, Apache MINA SSHD suffered from the issue that is more widely known as CVE-2023-48795. An attacker that can intercept traffic between client and server could drop certain packets from the stream, potentially causing client and server to consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack The mitigations to prevent this type of attack were implemented in Apache MINA SSHD 2.12.0, both client and server side. Users are recommended to upgrade to at least this version. Note that both the client and the server implementation must have mitigations applied against this issue, otherwise the connection may still be affected.

2.12.0
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-r4e4-u4s6-63gc	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA. In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" information about items outside the rooted tree via paths including parent navigation ("..") beyond the root, or involving symlinks. This issue affects Apache MINA: from 1.0 before 2.10. Users are recommended to upgrade to 2.10	CVE-2023-35887 GHSA-mjmq-gwgm-5qhm

Vulnerability

Summary

Aliases

VCID-r4e4-u4s6-63gc

CVE-2023-35887
GHSA-mjmq-gwgm-5qhm

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-16T23:05:47.821165+00:00	GitLab Importer	Affected by	VCID-zxcy-vvmk-xbag	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.sshd/sshd-common/CVE-2024-41909.yml	38.4.0
2026-04-16T22:33:32.410075+00:00	GitLab Importer	Affected by	VCID-r4e4-u4s6-63gc	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.sshd/sshd-common/CVE-2023-35887.yml	38.4.0
2026-04-12T00:23:46.497530+00:00	GitLab Importer	Affected by	VCID-zxcy-vvmk-xbag	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.sshd/sshd-common/CVE-2024-41909.yml	38.3.0
2026-04-11T23:52:30.406329+00:00	GitLab Importer	Affected by	VCID-r4e4-u4s6-63gc	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.sshd/sshd-common/CVE-2023-35887.yml	38.3.0
2026-04-03T00:31:24.294720+00:00	GitLab Importer	Affected by	VCID-zxcy-vvmk-xbag	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.sshd/sshd-common/CVE-2024-41909.yml	38.1.0
2026-04-02T23:55:41.531444+00:00	GitLab Importer	Affected by	VCID-r4e4-u4s6-63gc	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.sshd/sshd-common/CVE-2023-35887.yml	38.1.0
2026-04-02T16:59:52.746094+00:00	GHSA Importer	Fixing	VCID-r4e4-u4s6-63gc	https://github.com/advisories/GHSA-mjmq-gwgm-5qhm	38.1.0
2026-04-01T12:58:59.829190+00:00	GithubOSV Importer	Fixing	VCID-r4e4-u4s6-63gc	https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-mjmq-gwgm-5qhm/GHSA-mjmq-gwgm-5qhm.json	38.0.0