Jsch
Monthly
Certificate revocation bypass in mwiede jsch through version 2.28.5 allows unauthenticated remote attackers to have a revoked SSH host certificate accepted as trusted during host verification. The `setKnownHosts()` parser in `KnownHosts.java` failed to recognize OpenSSH certificate key types (e.g., `ssh-ed25519-cert-v01@openssh.com`) as valid when paired with the `@revoked` marker, causing such entries to be skipped rather than tracked in the revocation pool - silently nullifying the revocation check. A public proof-of-concept is available via GitHub issue #1091, and the fix is released as version 2.28.6.
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 53.6%.
Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ (dot dot backslash). Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 29.9%.
Certificate revocation bypass in mwiede jsch through version 2.28.5 allows unauthenticated remote attackers to have a revoked SSH host certificate accepted as trusted during host verification. The `setKnownHosts()` parser in `KnownHosts.java` failed to recognize OpenSSH certificate key types (e.g., `ssh-ed25519-cert-v01@openssh.com`) as valid when paired with the `@revoked` marker, causing such entries to be skipped rather than tracked in the revocation pool - silently nullifying the revocation check. A public proof-of-concept is available via GitHub issue #1091, and the fix is released as version 2.28.6.
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 53.6%.
Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ (dot dot backslash). Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 29.9%.