CVE-2021-30129 : A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow

A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache Mina SSHD 2.7.0

Published 2021-07-12 12:15:08

Updated 2022-07-25 18:15:42

Source Apache Software Foundation

View at NVD, CVE.org

Products affected by CVE-2021-30129

Apache » Sshd
Versions from including (>=) 2.0.0 and before (<) 2.7.0
cpe:2.3:a:apache:sshd:*:*:*:*:*:*:*:*
Matching versions
Oracle » Oss Support Tools » Version: 2.12.42
cpe:2.3:a:oracle:oss_support_tools:2.12.42:*:*:*:*:*:*:*
Matching versions
Oracle » Flexcube Universal Banking
Versions from including (>=) 14.0.0 and up to, including, (<=) 14.3.0
cpe:2.3:a:oracle:flexcube_universal_banking:*:*:*:*:*:*:*:*
Matching versions
Oracle » Flexcube Universal Banking » Version: 14.5
cpe:2.3:a:oracle:flexcube_universal_banking:14.5:*:*:*:*:*:*:*
Matching versions
Oracle » Banking Payments » Version: 14.5
cpe:2.3:a:oracle:banking_payments:14.5:*:*:*:*:*:*:*
Matching versions
Oracle » Retail Customer Management And Segmentation Foundation » Version: 18.0
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:*
Matching versions
Oracle » Retail Customer Management And Segmentation Foundation » Version: 19.0
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:*
Matching versions
Oracle » Communications Cloud Native Core Console » Version: 1.9.0
cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:*
Matching versions
Oracle » Banking Treasury Management » Version: 14.5
cpe:2.3:a:oracle:banking_treasury_management:14.5:*:*:*:*:*:*:*
Matching versions
Oracle » Banking Trade Finance » Version: 14.5
cpe:2.3:a:oracle:banking_trade_finance:14.5:*:*:*:*:*:*:*
Matching versions
Oracle » Middleware Common Libraries And Tools » Version: 12.2.1.4.0
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*
Matching versions
Oracle » Middleware Common Libraries And Tools » Version: 12.2.1.3.0
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.3.0:*:*:*:*:*:*:*
Matching versions
Oracle » Middleware Common Libraries And Tools » Version: 14.1.1.0.0
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:14.1.1.0.0:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2021-30129

Top countries where our scanners detected CVE-2021-30129

Top open port discovered on systems with this issue 22

IPs affected by CVE-2021-30129 197

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2021-30129!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2021-30129

EPSS FAQ

0.28%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 48 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-30129

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:L/Au:S/C:N/I:N/A:P	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2021-30129

CWE-772 Missing Release of Resource after Effective Lifetime

The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2021-30129

https://lists.apache.org/thread.html/r6d4f78e192a0c8eabd671a018da464024642980ecd24096bde6db36f%40%3Cusers.mina.apache.org%3E

CVE-2021-30129: DoS/OOM leak vulnerability in Apache Mina SSHD Server - Pony Mail
Mailing List;Vendor Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html

Oracle Critical Patch Update Advisory - April 2022
Patch;Third Party Advisory

CVEs referencing this url
https://lists.apache.org/thread.html/red01829efa2a8c893c4baff4f23c9312bd938543a9b8658e172b853b@%3Cannounce.apache.org%3E

CVE-2021-30129: DoS/OOM leak vulnerability in Apache Mina SSHD Server - Pony Mail
Mailing List;Vendor Advisory
https://lists.apache.org/thread.html/r6d4f78e192a0c8eabd671a018da464024642980ecd24096bde6db36f@%3Cusers.mina.apache.org%3E

CVE-2021-30129: DoS/OOM leak vulnerability in Apache Mina SSHD Server - Pony Mail
Mailing List;Vendor Advisory
https://www.oracle.com/security-alerts/cpujul2022.html

Oracle Critical Patch Update Advisory - July 2022

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2021/07/12/1

oss-security - CVE-2021-30129: DoS/OOM leak vulnerability in Apache Mina SSHD Server
Mailing List;Third Party Advisory