{"schemaVersion":3,"id":"CVE-2024-41909","aliases":["CGA-4j49-gfp8-qj49","CGA-q62m-4ww6-9rrc","CGA-25vp-hffr-67g5","CGA-3fjr-9548-jp93","CGA-5c7q-qccx-gprc","CGA-p944-6vv6-5c6f","CGA-pm8r-wmcr-69qx","GHSA-2326-hx7g-3m9r","CGA-w9r4-cmqv-vv9w"],"status":"published","duplicateOf":null,"title":null,"description":"Like many other SSH implementations, Apache MINA SSHD suffered from the issue that is more widely known as CVE-2023-48795. An attacker that can intercept traffic between client and server could drop certain packets from the stream, potentially causing client and server to consequently end up with a connection for which\nsome security features have been downgraded or disabled, aka a Terrapin\nattack\n\nThe mitigations to prevent this type of attack were implemented in Apache MINA SSHD 2.12.0, both client and server side. Users are recommended to upgrade to at least this version. Note that both the client and the server implementation must have mitigations applied against this issue, otherwise the connection may still be affected.","dates":{"published":"2024-08-12T16:00:29.568Z","modified":"2025-03-27T15:31:20.659Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.9,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":5.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":5.6,"impact":6,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Maven","score":8.2,"severity":"high","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Maven","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":5.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00581,"percentile":0.46724,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.00499999999999997,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00576},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00581,"percentile":0.46724}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00576,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00581,"percentile":0.46724}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-354","name":"Improper Validation of Integrity Check Value","description":"The product does not validate or incorrectly validates the integrity check values or \"checksums\" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/354.html"}],"affected":[{"vendor":"apache software foundation","product":"apache mina sshd","name":"Apache MINA SSHD","label":"apache mina sshd","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.11.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.11.0","eol":null,"hubHref":"/vendor/apache_software_foundation/apache_mina_sshd"},{"vendor":"apache","product":"mina_sshd","name":"mina sshd","label":"mina_sshd","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.11.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.11.0","eol":null,"hubHref":"/vendor/apache/mina_sshd"},{"vendor":"chainguard","product":"eco-java-gradle-8.7","name":"eco-java-gradle-8.7","label":"eco-java-gradle-8.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/eco-java-gradle-8.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"hadoop-fips-3.4.2","name":"hadoop-fips-3.4.2","label":"hadoop-fips-3.4.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/hadoop-fips-3.4.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"hadoop-fips-3.5","name":"hadoop-fips-3.5","label":"hadoop-fips-3.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/hadoop-fips-3.5","purlType":"apk","versions":[{"text":"< 3.5.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.5.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"sonarqube","name":"sonarqube","label":"sonarqube","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/sonarqube","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"sonarqube","name":"sonarqube","label":"sonarqube","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/sonarqube","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"org.apache.sshd","product":"sshd-common","name":"org.apache.sshd:sshd-common","label":"sshd-common","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.apache.sshd/sshd-common","purlType":"maven","versions":[{"text":"< 2.12.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12.0","eol":null,"hubHref":null}],"affectedCount":8,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/apache/mina-sshd/issues/445","label":"github.com/apache/mina-sshd/issues/445","hostname":"github.com","tags":["Issue Tracking","REPORT","WEB"]},{"url":"https://lists.apache.org/thread/vwf1ot8wx1njyy8n19j5j2tcnjnozt3b","label":"lists.apache.org/thread/vwf1ot8wx1njyy8n19j5j2tcnjnozt3b","hostname":"lists.apache.org","tags":["Vendor Advisory","Advisory","WEB","Mailing List"]},{"url":"https://security.netapp.com/advisory/ntap-20241011-0006/","label":"security.netapp.com/advisory/ntap-20241011-0006/","hostname":"security.netapp.com","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41909.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41909.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41909","label":"nvd.nist.gov/vuln/detail/CVE-2024-41909","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/apache/mina-sshd/pull/449","label":"github.com/apache/mina-sshd/pull/449","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/mina-sshd/commit/315739e4e9d1dc7a4ff32ea64936982ed0b73e76","label":"github.com/apache/mina-sshd/commit/315739e4e9d1dc7a4ff32ea64936982ed0b73e76","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/mina-sshd/commit/6b0fd46f64bcb75eeeee31d65f10242660aad7c1","label":"github.com/apache/mina-sshd/commit/6b0fd46f64bcb75eeeee31d65f10242660aad7c1","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/mina-sshd/commit/7b2c781640a7a78a9455b86593a1f63c9e8cab92","label":"github.com/apache/mina-sshd/commit/7b2c781640a7a78a9455b86593a1f63c9e8cab92","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/apache/mina-sshd","label":"github.com/apache/mina-sshd","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/apache/mina-sshd/releases/tag/sshd-2.12.0","label":"github.com/apache/mina-sshd/releases/tag/sshd-2.12.0","hostname":"github.com","tags":["WEB"]},{"url":"https://security.netapp.com/advisory/ntap-20241011-0006","label":"security.netapp.com/advisory/ntap-20241011-0006","hostname":"security.netapp.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-W6X4-873X-M2RR"]},"timeline":[{"kind":"published","date":"2024-08-12T16:00:29.568Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-03-27T15:31:20.659Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":24,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T17:18:51.366Z","stale":false,"partial":false}}