CVE-2021-30129 DoS/OOM leak vulnerability in Apache Mina SSHD Server
An attacker can cause an OutOfMemory error in Apache Mina SSHD, leading to a denial of service, by exploiting SFTP or port forwarding features.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-30129?
CVE-2021-30129 is a medium-severity denial of service vulnerability in Oracle Flexcube Universal Banking, published on 12 Jul 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache Mina SSHD 2.7.0
Weakness: CWE-772
Which versions are affected by CVE-2021-30129?
4 open source packages ship an affected version, including org.apache.sshd:sshd-core and org.apache.sshd:sshd-mina. It affects 9 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.sshd:sshd-core Maven | From 2.0.0 | 2.7.0 |
org.apache.sshd:sshd-core Maven | From 2.0.0 | 2.7.0 |
org.apache.sshd:sshd-mina Maven | From 2.0.0 | 2.7.0 |
org.apache.sshd:sshd-mina Maven | From 2.0.0 | 2.7.0 |
Products include Apache Sshd, Oracle Banking Payments, Oracle Banking Trade Finance, Oracle Banking Treasury Management, Oracle Communications Cloud Native Core Console, Oracle Flexcube Universal Banking and 3 more.
How do I fix CVE-2021-30129?
Upgrade org.apache.sshd:sshd-core to 2.7.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-30129 being exploited?
There is no known exploitation of CVE-2021-30129 in the wild and no public exploit code.
Other vulnerabilities in Oracle Flexcube Universal Banking
Sources
Also known as GHSA-9279-7hph-r3xw, MINI-5cpm-q7xg-fg6g, OESA-2021-1312.