libmina-sshd-java_2.19.0-1_source.changes ACCEPTED into unstable

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 04 Nov 2026 21:31:50 +0100
Source: libmina-sshd-java
Architecture: source
Version: 2.19.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers <pkg-java-maintainers at lists.alioth.debian.org>
Changed-By: Pierre Gruet <pgt at debian.org>
Closes: 1138634 1142679
Changes:
 libmina-sshd-java (2.19.0-1) unstable; urgency=medium
 .
   * New upstream version 2.19.0:
     Fixes the following CVE:
     - CVE-2026-48827:
     Path traversal vulnerability in Apache MINA SSHD bundle sshd-git.
     Lack of path validation in git-upload-pack, git-receive-pack, and
     other git operations allows users authenticated over SSH access to
     git repositories outside the configured git server root directory.
     Applications are affected if they use org.apache.sshd:sshd-git.
     Applications not using sshd-git are not affected.
     - CVE-2026-56452:
     Path traversal in the sshd-scp component of Apache MINA SSHD. Apache
     MINA SSHD is a Java library for client-side and server-side SSH.
     The implementation of receiving files or directories via SCP did not
     validate filenames in SCP "C" or "D" commands. A malicious sender
     could send filenames containing paths, resulting in files to be
     written in attacker-controlled places.
     - CVE-2026-56624:
     Improper certificate validation in Apache MINA SSHD (server-
     side). Apache MINA SSHD is a Java library for client-side and
     server-side SSH.     Server-side OpenSSH user certificate validation
     during user authentication in an Apache MINA SSHD server did not
     check for the unsupported force-command or verify-required options
     that could be embedded in the certificate, nor did it validate these
     options. As a result it was possible that a user could authenticate
     with such a certificate that included a force-command option but
     still was able to execute other commands. What other command exactly
     would be available to the user depends on the implementation of the
     server.
     - CVE-2026-58624:
     Improper input validation in sshd-git in Apache MINA SSHD. Apache
     MINA SSHD is a Java library for client-side and server-side SSH.
     Component org.apache.sshd:sshd-git provides though its
     GitPgmCommandFactory a way to configure an Apache MINA SSHD server
     such that SSH clients can remotely execute git commands via the JGit
     library on git repositories stored on the server.     This
     GitPgmCommandFactory allowed a user authenticated via SSH to run any
     JGit command available, including commands that could write files at
     arbitrary places such as git archive with the --output option.
     Affected are SSH servers implemented with Apache MINA SSHD and using
     the GitPgmCommandFactory. If the GitPgmCommandFactory is not
     configured on the server, the server is not affected.
     (Closes: #1138634, #1142679)
   * Refreshing patches
   * Switching to debhelper-compat 14, removing misc: substvar
   * Raising Standards version to 4.7.4:
     - Removing Priority: optional, which is now defaults
     - Removing R-R-R: no, which is now defaults
   * Raising d/watch version to 5
   * Skipping second and identical run of tests with mina 2.2.x
   * Skipping additional classpath requirements of bouncycastle fips classes
   * B-D on junit5
   * Updating versioned B-D on libapacheds-java
   * Updating the list of POM files
   * Patching out more tests requiring unpackaged org.testcontainers
Checksums-Sha1:
 fdda50dc16ad0ebca9064843ec79c839be99f44f 2761 libmina-sshd-java_2.19.0-1.dsc
 a5f09c97764622567fc5561ba4bab7610ea0934b 1919839 libmina-sshd-java_2.19.0.orig.tar.gz
 a895f43207b114e40e4d4d693a92ecd962e2addd 11388 libmina-sshd-java_2.19.0-1.debian.tar.xz
 d18619fbe1f003153ea40ea1da9839e3d4d702ca 18200 libmina-sshd-java_2.19.0-1_amd64.buildinfo
Checksums-Sha256:
 602593801804ce36d7328c0efcca2f6347b92543dd323f8f9b3421a8c719541e 2761 libmina-sshd-java_2.19.0-1.dsc
 fb424c1719fa3db871a9fe1b31b5a60c3fc0d07f75c745c0b654984b5e5f2d14 1919839 libmina-sshd-java_2.19.0.orig.tar.gz
 6804586eecc733edb3fc17751c3ee2c8d1a42e113a9290ada8eda83e0bc3b80f 11388 libmina-sshd-java_2.19.0-1.debian.tar.xz
 43e21472480cd27dd2175e1530d16c985fea8b689016ca96af29c598c19be03a 18200 libmina-sshd-java_2.19.0-1_amd64.buildinfo
Files:
 8963d23f4a079fea435dda304336b095 2761 java optional libmina-sshd-java_2.19.0-1.dsc
 9647e589ed971c68454a60e89e77084f 1919839 java optional libmina-sshd-java_2.19.0.orig.tar.gz
 1150d33bae0c4d4d4c0d8ab568e2e630 11388 java optional libmina-sshd-java_2.19.0-1.debian.tar.xz
 47d0f600dfa92dd39f854163fc54fcb4 18200 java optional libmina-sshd-java_2.19.0-1_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEM8soQxPpC9J9y0UjYAMWptwndHYFAmrrmLsACgkQYAMWptwn
dHbFuhAAsL/Q26UiVsx5Kj3vCRwU1uq+XcaUyttCuekbNgHVky6KnrvpVdf0Ek/G
vIM5GU5hamY1SDWLOjNhuKSW2jNmCkbufaRfDFgS+co1qhRzN0s2JL88l1MT+vkj
KqqHhG+1cT2DITeHKkVSvtE+zqTYOPreYmEyl1J/3rVO+gkxBf8sVYXpSlUgc7QY
hfV8Ad+gJncnaPP+GRmOOgCsLLic5NxdLmKi0ysyPGVYIptR3tM4YoN4mnv8FwS/
+tMSDKWMo1sp7F11Fx4J4NPm0/AKyr1i66EwTmlDxzDrIduW5ucN+AtxiLvEC6Yi
ITlHhGmrjCWPtj4oW8ScAURj1t3U1HbxDfL5UAW6o/jWPoTL5QF1DJVJUvOkifcc
dQykDOw6BxdcLA4n3tLQFUz1yYZ07zpt7dgQTt30HO2dPFteTDiEpxx53ihyp4UT
OPcbGWIXL+4DP/K87uofTKzJxZ6n1MLqMH0yDuZ/elfBQsG81619keQku6YxTMFf
6cbL/kJYbw+Y2gsEKOtAJSJeMfkK2rdORIjcMV3KT2rrahHZ365ey0C4Qzu6Gcr7
B0vqRVHP3G8FaNnPqHEAyM+WhXHrJNyvWG9xO3r05qqlQ9ZtfUn7MVRXXnsILo02
xuDuU9QSS81zUWMjuzjTa3g9ZYN0fTa+ze8HlogrfveYE0HIwu8=
=QnTG
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-maintainers/attachments/20261104/828946ab/attachment-0001.sig>