Skip to content
Fencer Vulns
critical 9.8

CVE-2022-45047 json

Apache MINA SSHD: Java unsafe deserialization vulnerability

published 2022-11-16 3 y ago modified 2026-06-17 4 mo ago also GHSA-fhw8-8j55-vwgq , EUVD-2022-7328

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
3.8%
EPSS 3.8% chance of exploitation in 30 days, percentile 90%
public exploits
0
none known

Summary

Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server.

Patch / fix

  • maven org.apache.sshd:sshd-common 2.9.2
  • maven org.apache.sshd:sshd-core 2.9.2
  • jenkins openshift 4.9 2.361.1.1675668150-1.el8
  • jenkins-2-plugins openshift 4.9 4.9.1675668922-1.el8
  • jenkins ocp tools 4.11 2.387.1.1683009763-3.el8
  • jenkins-2-plugins ocp tools 4.11 4.11.1683009941-1.el8
  • rh-sso7-keycloak red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el7sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el7sso
  • rh-sso7-keycloak red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el8sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el8sso

red hat advisories RHSA-2023:0777RHSA-2025:1747RHSA-2025:1746RHSA-2023:3198RHSA-2023:1043RHSA-2023:1044

  • apache-sshd SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES for SAP 15 SP2 +10 more 2.12.0-150200.5.8.1
  • apache-parent openSUSE Leap 15.5 31-150200.3.12.1

suse advisories SUSE-SU-2024:0224-1

  • apache-sshd openSUSE Tumbleweed 2.9.2-1.1

opensuse advisories openSUSE-SU-2024:12511-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-45047 updated cvss 9.8

mina-sshd: Java unsafe deserialization vulnerability

  • Red Hat Migration Toolkit for Applications 6 mina-sshd Red Hat Migration Toolkit for Runtimes mina-sshd Red Hat Fuse 7 sshd-common Red Hat Integration Camel Quarkus 1 sshd-common
    affected: workaround, no fix available
  • Red Hat JBoss Data Grid 7 mina-sshd mina-sshd Red Hat JBoss Enterprise Application Platform 6 sshd-common, keycloak-adapter-sso7_5-eap6 keycloak-adapter-sso7_5-eap6 Red Hat JBoss Fuse 6 mina-sshd mina-sshd Red Hat JBoss Fuse Service Works 6 mina-sshd mina-sshd
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins Red Hat OpenStack Platform 13 (Queens) opendaylight
    affected: workaround, no fix available
  • Red Hat Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8 7.6-20
    fixed: vendor fix RHSA-2023:1047
  • Red Hat OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins 4.11.1683009941-1.el8
    fixed: vendor fix RHSA-2023:3198
  • Red Hat OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins 4.12.1675702407-1.el8
    fixed: vendor fix RHSA-2023:1064
  • Red Hat build of Quarkus
    fixed: vendor fix RHSA-2023:0758
  • Red Hat build of Quarkus Platform 2.7.6.SP3
    fixed: vendor fix RHSA-2022:8957
show 17 more
  • Red Hat Data Grid 8.4.1
    fixed: vendor fix RHSA-2023:0713
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-sshd 2.9.2-1.redhat_00001.1.el7eap
    fixed: vendor fix RHSA-2023:0552
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-sshd 2.9.2-1.redhat_00001.1.el8eap
    fixed: vendor fix RHSA-2023:0553
  • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-apache-sshd 2.9.2-1.redhat_00001.1.el9eap
    fixed: vendor fix RHSA-2023:0554
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-jettison 1.3.8-2.redhat_00002.1.ep7.el7, eap7-velocity 1.7.0-3.redhat_00006.1.ep7.el7, eap7-wildfly 7.1.9-2.GA_redhat_00002.1.ep7.el7, eap7-apache-cxf 3.1.16-4.redhat_00003.1.ep7.el7, eap7-netty 4.1.63-1.Final_redhat_00002.1.ep7.el7, eap7-apache-cxf-rt 3.1.16-4.redhat_00003.1.ep7.el7, +23 more
    fixed: vendor fix RHSA-2025:1746
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-jettison 1.5.2-2.redhat_00002.1.el7eap, eap7-wildfly 7.3.12-3.GA_redhat_00002.1.el7eap, eap7-netty 4.1.63-4.Final_redhat_00002.1.el7eap, eap7-jackson-core 2.10.4-2.redhat_00004.1.el7eap, eap7-snakeyaml 1.33.0-1.SP1_redhat_00001.1.el7eap, eap7-resteasy 3.11.6-1.Final_redhat_00001.1.el7eap, +35 more
    fixed: vendor fix RHSA-2025:1747
  • Red Hat JBoss Enterprise Application Platform 7.4.9 sshd-common 2.9.2.redhat-00001
    fixed: vendor fix RHSA-2023:0556
  • Red Hat OpenShift Container Platform 4.9 jenkins-2-plugins 4.9.1675668922-1.el8
    fixed: vendor fix RHSA-2023:0777
  • Red Hat OpenShift Container Platform 4.10 jenkins-2-plugins 4.10.1675144701-1.el8
    fixed: vendor fix RHSA-2023:0560
  • Red Hat Single Sign-On 7
    fixed: vendor fix RHSA-2023:1049
  • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el7sso
    fixed: vendor fix RHSA-2023:1043
  • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el8sso
    fixed: vendor fix RHSA-2023:1044
  • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el9sso
    fixed: vendor fix RHSA-2023:1045
  • Red Hat Virtualization 4 Hypervisor for RHEL 8 vdsm 4.50.3.6-1.el8ev, vdsm-hook-fcoe 4.50.3.6-1.el8ev, vdsm-hook-vhostmd 4.50.3.6-1.el8ev, vdsm-hook-checkips 4.50.3.6-1.el8ev, vdsm-hook-cpuflags 4.50.3.6-1.el8ev, vdsm-hook-nestedvt 4.50.3.6-1.el8ev, +4 more Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts vdsm 4.50.3.6-1.el8ev, vdsm-api 4.50.3.6-1.el8ev, vdsm-http 4.50.3.6-1.el8ev, vdsm-client 4.50.3.6-1.el8ev, vdsm-common 4.50.3.6-1.el8ev, vdsm-python 4.50.3.6-1.el8ev, +13 more Red Hat RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 apache-sshd 2.9.2-0.1.el8ev, apache-sshd-javadoc 2.9.2-0.1.el8ev
    fixed: vendor fix RHSA-2023:0074
  • Red Hat RHINT Camel-Springboot 3.18.3.P2
    fixed: vendor fix RHSA-2023:3641
  • Red Hat RHPAM 7.13.4 async
    fixed: vendor fix RHSA-2023:4983
  • Red Hat OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins 2.387.1.1683009763-3.el8 Red Hat OpenShift Developer Tools and Services for OCP 4.12 jenkins 2.361.4.1675702346-3.el8 Red Hat AMQ Broker 7 sshd-common Red Hat build of Apache Camel for Spring Boot 3 sshd-common Red Hat Integration Camel K 1 sshd-common Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-jettison 1.5.2-1.redhat_00002.1.el7eap, eap7-wildfly 7.4.9-4.GA_redhat_00003.1.el7eap, eap7-jackson-core 2.12.7-1.redhat_00003.1.el7eap, eap7-undertow 2.2.22-1.SP3_redhat_00001.1.el7eap, eap7-woodstox-core 6.4.0-1.redhat_00001.1.el7eap, eap7-elytron-web 1.9.3-1.Final_redhat_00001.1.el7eap, +42 more
    +1 more products
    Red Hat JBoss EAP 7.4 for RHEL 8 eap7-jettison 1.5.2-1.redhat_00002.1.el8eap, eap7-wildfly 7.4.9-4.GA_redhat_00003.1.el8eap, eap7-jackson-core 2.12.7-1.redhat_00003.1.el8eap, eap7-undertow 2.2.22-1.SP3_redhat_00001.1.el8eap, eap7-woodstox-core 6.4.0-1.redhat_00001.1.el8eap, eap7-elytron-web 1.9.3-1.Final_redhat_00001.1.el8eap, +40 more
    not affected: vulnerable code not present

7 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
6 mo ago

Exploit prediction

3.81% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.apache.sshd:sshd-common
<2.9.2
2.9.2
maven org.apache.sshd:sshd-core
<2.9.2
2.9.2

Affected products

  • Apache Software Foundation Apache MINA SSHD

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.