Threats tagged 'ghsa-v223-2p4c-wp64'

Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 contain a vulnerability in the sshd-core component related to the asynchronous authentication mechanism. This flaw can lead to authentication bypass by skipping signature checks in public-key or hostbased authentication under certain rare implementation conditions. The issue is fixed in versions 2.20.0 and 3.0.0-M6, which also disallow asynchronous authentication with public-key or hostbased schemes, closing the session if attempted.