Bug#1142679: mina2: CVE-2026-56452 CVE-2026-56624 CVE-2026-58624

[Salvatore Bonaccorso]

Source: mina2
Version: 2.2.1-4
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerabilities were published for mina2.

CVE-2026-56452[0]:
| Path traversal in the sshd-scp component of Apache MINA SSHD. Apache
| MINA SSHD is a Java library for client-side and server-side SSH.
| The implementation of receiving files or directories via SCP did not
| validate filenames in SCP "C" or "D" commands. A malicious sender
| could send filenames containing paths, resulting in files to be
| written in attacker-controlled places.     The issue affects only
| *  applications that use no longer supported Apache MINA SSHD
| versions < 2.0.0 and use the SCP functions to receive files,   *  or
| applications using sshd-scp in Apache MINA SSHD >= 2.0.0 to receive
| files.     Applications using Apache MINA SSHD >= 2.0.0 not using
| sshd-scp are not affected.     The issue is fixed in Apache MINA
| 2.19.0 and 3.0.0-M5. Affected applications are advised to upgrade to
| these versions.


CVE-2026-56624[1]:
| Improper certificate validation in Apache MINA SSHD (server-
| side). Apache MINA SSHD is a Java library for client-side and
| server-side SSH.     Server-side OpenSSH user certificate validation
| during user authentication in an Apache MINA SSHD server did not
| check for the unsupported force-command or verify-required options
| that could be embedded in the certificate, nor did it validate these
| options. As a result it was possible that a user could authenticate
| with such a certificate that included a force-command option but
| still was able to execute other commands. What other command exactly
| would be available to the user depends on the implementation of the
| server.     This issue is fixed in Apache MINA SSHD 2.19.0 and
| 3.0.0-M5. Applications are advised to upgrade to these versions.
| The fix rejects OpenSSH user certificates that include these
| options, since Apache MINA SSHD implements neither force-command nor
| sk-*-cert-v01 at openssh.com user certificates (which are the only ones
| for which verify-required would make sense).


CVE-2026-58624[2]:
| Improper input validation in sshd-git in Apache MINA SSHD. Apache
| MINA SSHD is a Java library for client-side and server-side SSH.
| Component org.apache.sshd:sshd-git provides though its
| GitPgmCommandFactory a way to configure an Apache MINA SSHD server
| such that SSH clients can remotely execute git commands via the JGit
| library on git repositories stored on the server.     This
| GitPgmCommandFactory allowed a user authenticated via SSH to run any
| JGit command available, including commands that could write files at
| arbitrary places such as git archive with the --output option.
| Affected are SSH servers implemented with Apache MINA SSHD and using
| the GitPgmCommandFactory. If the GitPgmCommandFactory is not
| configured on the server, the server is not affected.     It is
| recommended to upgrade affected servers to Apache MINA SSHD 2.19.0
| or 3.0.0-M5, which fix this issue.     The issue is fixed by
| restricting the available commands to a small whitelist of
| uncritical commands (such as git log). git archive is also allowed,
| but its --output argument is ignored and the archive is always sent
| through the SSH channel to the client.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-56452
    https://www.cve.org/CVERecord?id=CVE-2026-56452
[1] https://security-tracker.debian.org/tracker/CVE-2026-56624
    https://www.cve.org/CVERecord?id=CVE-2026-56624
[2] https://security-tracker.debian.org/tracker/CVE-2026-58624
    https://www.cve.org/CVERecord?id=CVE-2026-58624

Regards,
Salvatore