[From nobody Thu Nov 5 10:21:09 2026 Received: (at 1149652-close) by bugs.debian.org; 5 Nov 2026 10:19:18 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.1 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA, FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE, SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 91; hammy, 150; neutral, 438; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from mailly.debian.org ([2001:41b8:202:deb:6564:a62:52c3:4b72]:56890) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xOuYv-00Dw2g-1Y for 1149652-close@bugs.debian.org; Thu, 05 Nov 2026 10:19:18 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mailly.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xOuYu-00BSDJ-0D for 1149652-close@bugs.debian.org; Thu, 05 Nov 2026 10:19:16 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=TCcrSojPd5gdWFh15EEoOk4wXBFQG6DYINUWaf1p2Ao=; b=jotXjWUyMvf+Q5qZdBzON5tRCn uPQUC8XizLCxaLt3PNua5CeMEfN4Y6cY/2Nk1He0mR+4fkNKqgX44wLup+IQzKXsjFpQXUvQBBU+O vwWsglhxudsrg/gAJHflhosko0Fa2PdLVXi8WV4JhLDl8WjB3uUfhVVPxKsFsm97Q7BM6u4Q3f7Ai ea07KcDWKH/CRWysfXCfN0ZLWL1q04i4plL+LhHw78EOItxqR58953uJuTR836V/DRbOd3fW4XJOo 565HIyHeqbfd6R7/UgUvWpJBfZkEaLxE2lts6LaFQMZTkMm2O6RCTxf3jCT7uv094QwpPulFzSOL8 l+/On5PA==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1xOuYt-00000003kR6-0Pkt; Thu, 05 Nov 2026 10:19:15 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Pierre Gruet <pgt@debian.org> To: 1149652-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: libmina-sshd-java Debian: DAK Debian-Changes: libmina-sshd-java_2.20.1-1_source.changes Debian-Source: libmina-sshd-java Debian-Version: 2.20.1-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1149652: fixed in libmina-sshd-java 2.20.1-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============8521491860844281948==" Message-Id: <E1xOuYt-00000003kR6-0Pkt@fasolo.debian.org> Date: Thu, 05 Nov 2026 10:19:15 +0000 --===============8521491860844281948== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: libmina-sshd-java Source-Version: 2.20.1-1 Done: Pierre Gruet <pgt@debian.org> We believe that the bug you reported is fixed in the latest version of libmina-sshd-java, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1149652@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Pierre Gruet <pgt@debian.org> (supplier of updated libmina-sshd-java package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 05 Nov 2026 11:01:37 +0100 Source: libmina-sshd-java Architecture: source Version: 2.20.1-1 Distribution: unstable Urgency: medium Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian= .org> Changed-By: Pierre Gruet <pgt@debian.org> Closes: 1149652 Changes: libmina-sshd-java (2.20.1-1) unstable; urgency=3Dmedium . * New upstream version 2.20.1: Fixes the following CVE: - CVE-2026-77185: Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (presumed rare) way to implement an SSH server. Apache MINA SSHD is a Java library for client- and server-side SSH. In the server part of the library, a mechanism to perform "asynchronous authentication" exists. A server implemented with Apache MINA SSHD must contain explicit code to make use of this feature. The implementation of this feature was flawed and could potentially lead to skipping checking the signature in public-key or hostbased authentication, or returning a wrong result. - CVE-2026-93994: Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods "publickey,publickey". Apache MINA SSHD provides an equivalent configuration mechanism. In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass. - CVE-2026-93995: Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that authenticated SSH clients can remotely execute git commands via the JGit library on git repositories stored on the server. In CVE-2026-58624 this mechanism was restricted to only a few git commands, including "git archive" without "--output" or "-o" options such that the resulting archive would not be written on the server but instead sent back to the client over the SSH connection. The fix done for CVE-2026-58624 was insufficient as it missed removing the single-argument "-o=3Dfile.zip" version of the command parameter from the "archive" command. - CVE-2026-93996: Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP command protocol is line-oriented with LF-terminated lines. The protocol handler in sshd-scp did not impose any limit on the length of such protocol lines. A malicious peer just sending a junk command containing a never-ending sequence of characters but never a LF would cause the receiver to allocate memory to store this whole junk command, exhausting memory and crashing the application with an OutOfMemoryError. - CVE-2026-94002: Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The sshd-sftp component provides support for SFTP. The SFTP client implementation, when receiving a reply, did not check that this reply corresponded to a request sent earlier. Unsolicited replies would be stored but never consumed. A malicious server could keep sending unsolicited replies until available memory in the client was exhausted. - CVE-2026-94029: Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check- file-name/check-file-handle extension. Apache MINA SSHD is a Java library for client-side and server-side SSH. Using a very small "block size" (for instance 256, which is the minimum) on a huge file generates many (file size / block size) hashes. The resulting SFTP reply message was accumulated fully in memory server-side, which could, with a suitably large (possibly sparse) file exhaust the server-side memory, taking down the server. - CVE-2026-94052: A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey authentication on the server side with an LDAP server. sshd-ldap is an optional component. SSH servers implemented with Apache MINA SSHD are affected only if they use sshd-ldap and do configure an LdapPasswordAuthenticator to be used for password authentication. Normal password authentication via the built-in mechanisms in sshd- core is _not_ affected by this vulnerability, which concerns only LdapPasswordAuthenticator. - CVE-2026-94053: Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey authentication on the server side with an LDAP server. sshd-ldap is an optional component. SSH servers implemented with Apache MINA SSHD are affected only if they use sshd-ldap and do configure it to be used for password of public key authentication. Other Apache MINA SSHD servers are not affected. Lack of escaping LDAP filter metacharacters enabled successful authentication with username "*" and password "*". (Closes: #1149652) * Refreshing patches Checksums-Sha1: b2695571f232838f9e9371575327e5d8f74da181 2761 libmina-sshd-java_2.20.1-1.dsc ed756ffc3b4a90fee932897ffa70df003fa74063 1934832 libmina-sshd-java_2.20.1.or= ig.tar.gz 77fae91a234017ab5601276db9d78377c252c054 13112 libmina-sshd-java_2.20.1-1.de= bian.tar.xz 2467864088651d07e95f6011a6db25080b77563e 18095 libmina-sshd-java_2.20.1-1_so= urce.buildinfo Checksums-Sha256: aeed3dac45865c5e4fbd397500163593b79eacc41aade2dc1da598b033cbd2bd 2761 libmin= a-sshd-java_2.20.1-1.dsc 60c95630881e62cd4e002ccb270902cbba70ff6b39796914946654668f236adb 1934832 lib= mina-sshd-java_2.20.1.orig.tar.gz 4d82b1456dfd79a901b809f9da7c75958042144bd697d36415a87ae8fb6b4c57 13112 libmi= na-sshd-java_2.20.1-1.debian.tar.xz 260df68008a9abafae7bafe964f727e08b6dc845c98bd8d312f90ffc81f2b147 18095 libmi= na-sshd-java_2.20.1-1_source.buildinfo Files: 65420717c6eba45574a6abee136b4c30 2761 java optional libmina-sshd-java_2.20.1= -1.dsc 6954831ced47223b787914e13ce6d726 1934832 java optional libmina-sshd-java_2.2= 0.1.orig.tar.gz bca40ff2856c36e78591b7e6c48961e5 13112 java optional libmina-sshd-java_2.20.= 1-1.debian.tar.xz e720aff56b53e9e9ea29e4aeb7bfda8b 18095 java optional libmina-sshd-java_2.20.= 1-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEM8soQxPpC9J9y0UjYAMWptwndHYFAmrsVCEACgkQYAMWptwn dHb9kQ//Ux9aOsr1CcaEiewCpeCyhGDuAsIVwhJfkQzV6ZA6doiE1fawiSirFiJJ PAlotP7Z+Exwu+jwowOAoJX8uELIgp2a3dPowU0/YmgGK5+nP/EUN9DbMgnlUcRk x2s0KARnZHfWYt9NXRUKhIvH75tbdFozUX59Isd6T+lqJrvypcpJ5h7nMGdmcQ6Y ebLDXFxqTcyxPyY4TWV6eIatNLL7bysbXU8ad62FH6EMESjaTjnBOMam757bH8BB DS8/caRUh5FHT/GXKExlK+clHdcE1X4s62YjrvRZjyzopzCaL7MqorJMaqcF7gvC TnNYSHMMWcaakH4Jgn2s3Pon8e4hMFtOUrWdZFGJUOU2tsP98lT6l5DhyAGPOf2y dVidF7hdrDiTzdML+99LzO45rgxqTLYUVNgcjQOSjuWleyJJhsnDnvdSaxZIcaCK 8xlLH0f6hs5A4hAyO104j6E0Fk6lH/hSuGpu9PA7SOSPmmc099UNd6VDPKKdXRrX yGGIEVn/SbH8h6t/V4BhlcgeUiTA4SJaKSCs1+F9ZttCmQQCTofyFPr8FLYLoz1b nKdtOTZZhhBNzDInl+fqKH7XXJL0q8jSAhwrEAQy7G17yXej2TYRDnUIYusCJKyo HMVNCI0p7kjK9cfi8ZPMX74F1Kj+QWUeP6Eo29yPV9GyykNQtLk=3D =3DWpHy -----END PGP SIGNATURE----- --===============8521491860844281948== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCauxYIwAKCRCb9qggYcy5 IfKKAQCvmYN9qrjwHd+Xj/1g0UrBqIRYTb8H0VHESLqLUvKPDAD+Jd8N0gaVJj6d PhRbVaZYkNTxRApbxT1UJFHpmuzQSA8= =qd59 -----END PGP SIGNATURE----- --===============8521491860844281948==-- ]