CVE-2024-41909

{"id": "CVE-2024-41909", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2024-08-12T16:15:15.533", "references": [{"url": "https://github.com/apache/mina-sshd/issues/445", "tags": ["Issue Tracking"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/vwf1ot8wx1njyy8n19j5j2tcnjnozt3b", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "https://security.netapp.com/advisory/ntap-20241011-0006/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-354"}]}], "descriptions": [{"lang": "en", "value": "Like many other SSH implementations, Apache MINA SSHD suffered from the issue that is more widely known as CVE-2023-48795. An attacker that can intercept traffic between client and server could drop certain packets from the stream, potentially causing client and server to consequently end up with a connection for which \nsome security features have been downgraded or disabled, aka a Terrapin \nattack\n\nThe mitigations to prevent this type of attack were implemented in Apache MINA SSHD 2.12.0, both client and server side. Users are recommended to upgrade to at least this version. Note that both the client and the server implementation must have mitigations applied against this issue, otherwise the connection may still be affected."}, {"lang": "es", "value": "Como muchas otras implementaciones de SSH, Apache MINA SSHD sufri\u00f3 el problema m\u00e1s conocido como CVE-2023-48795. Un atacante que pueda interceptar el tr\u00e1fico entre el cliente y el servidor podr\u00eda descartar ciertos paquetes de la transmisi\u00f3n, lo que podr\u00eda provocar que el cliente y el servidor terminen con una conexi\u00f3n en la que algunas funciones de seguridad se hayan degradado o desactivado, tambi\u00e9n conocido como un ataque Terrapin. Las mitigaciones para evitar esto. tipo de ataque fueron implementados en Apache MINA SSHD 2.12.0, tanto del lado del cliente como del servidor. Se recomienda a los usuarios actualizar al menos a esta versi\u00f3n. Tenga en cuenta que tanto la implementaci\u00f3n del cliente como del servidor deben tener mitigaciones aplicadas contra este problema; de lo contrario, la conexi\u00f3n a\u00fan puede verse afectada."}], "lastModified": "2024-11-21T09:33:16.080", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:mina_sshd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F6C877D-CDBB-4A97-AEDD-A4FDF46259D7", "versionEndIncluding": "2.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}