libmina-sshd-java (2.20.1-1) unstable; urgency=medium * New upstream version 2.20.1: Fixes the following CVE: - CVE-2026-77185: Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (presumed rare) way to implement an SSH server. Apache MINA SSHD is a Java library for client- and server-side SSH. In the server part of the library, a mechanism to perform "asynchronous authentication" exists. A server implemented with Apache MINA SSHD must contain explicit code to make use of this feature. The implementation of this feature was flawed and could potentially lead to skipping checking the signature in public-key or hostbased authentication, or returning a wrong result. - CVE-2026-93994: Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods "publickey,publickey". Apache MINA SSHD provides an equivalent configuration mechanism. In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass. - CVE-2026-93995: Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that authenticated SSH clients can remotely execute git commands via the JGit library on git repositories stored on the server. In CVE-2026-58624 this mechanism was restricted to only a few git commands, including "git archive" without "--output" or "-o" options such that the resulting archive would not be written on the server but instead sent back to the client over the SSH connection. The fix done for CVE-2026-58624 was insufficient as it missed removing the single-argument "-o=file.zip" version of the command parameter from the "archive" command. - CVE-2026-93996: Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP command protocol is line-oriented with LF-terminated lines. The protocol handler in sshd-scp did not impose any limit on the length of such protocol lines. A malicious peer just sending a junk command containing a never-ending sequence of characters but never a LF would cause the receiver to allocate memory to store this whole junk command, exhausting memory and crashing the application with an OutOfMemoryError. - CVE-2026-94002: Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The sshd-sftp component provides support for SFTP. The SFTP client implementation, when receiving a reply, did not check that this reply corresponded to a request sent earlier. Unsolicited replies would be stored but never consumed. A malicious server could keep sending unsolicited replies until available memory in the client was exhausted. - CVE-2026-94029: Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check- file-name/check-file-handle extension. Apache MINA SSHD is a Java library for client-side and server-side SSH. Using a very small "block size" (for instance 256, which is the minimum) on a huge file generates many (file size / block size) hashes. The resulting SFTP reply message was accumulated fully in memory server-side, which could, with a suitably large (possibly sparse) file exhaust the server-side memory, taking down the server. - CVE-2026-94052: A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey authentication on the server side with an LDAP server. sshd-ldap is an optional component. SSH servers implemented with Apache MINA SSHD are affected only if they use sshd-ldap and do configure an LdapPasswordAuthenticator to be used for password authentication. Normal password authentication via the built-in mechanisms in sshd- core is _not_ affected by this vulnerability, which concerns only LdapPasswordAuthenticator. - CVE-2026-94053: Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey authentication on the server side with an LDAP server. sshd-ldap is an optional component. SSH servers implemented with Apache MINA SSHD are affected only if they use sshd-ldap and do configure it to be used for password of public key authentication. Other Apache MINA SSHD servers are not affected. Lack of escaping LDAP filter metacharacters enabled successful authentication with username "*" and password "*". (Closes: #1149652) * Refreshing patches -- Pierre Gruet Thu, 05 Nov 2026 11:01:37 +0100 libmina-sshd-java (2.19.0-1) unstable; urgency=medium * New upstream version 2.19.0: Fixes the following CVE: - CVE-2026-48827: Path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git-upload-pack, git-receive-pack, and other git operations allows users authenticated over SSH access to git repositories outside the configured git server root directory. Applications are affected if they use org.apache.sshd:sshd-git. Applications not using sshd-git are not affected. - CVE-2026-56452: Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames containing paths, resulting in files to be written in attacker-controlled places. - CVE-2026-56624: Improper certificate validation in Apache MINA SSHD (server- side). Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or verify-required options that could be embedded in the certificate, nor did it validate these options. As a result it was possible that a user could authenticate with such a certificate that included a force-command option but still was able to execute other commands. What other command exactly would be available to the user depends on the implementation of the server. - CVE-2026-58624: Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though its GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that SSH clients can remotely execute git commands via the JGit library on git repositories stored on the server. This GitPgmCommandFactory allowed a user authenticated via SSH to run any JGit command available, including commands that could write files at arbitrary places such as git archive with the --output option. Affected are SSH servers implemented with Apache MINA SSHD and using the GitPgmCommandFactory. If the GitPgmCommandFactory is not configured on the server, the server is not affected. (Closes: #1138634, #1142679) * Refreshing patches * Switching to debhelper-compat 14, removing misc: substvar * Raising Standards version to 4.7.4: - Removing Priority: optional, which is now defaults - Removing R-R-R: no, which is now defaults * Raising d/watch version to 5 * Skipping second and identical run of tests with mina 2.2.x * Skipping additional classpath requirements of bouncycastle fips classes * B-D on junit5 * Updating versioned B-D on libapacheds-java * Updating the list of POM files * Patching out more tests requiring unpackaged org.testcontainers -- Pierre Gruet Wed, 04 Nov 2026 21:31:50 +0100 libmina-sshd-java (2.13.2-3) unstable; urgency=medium * Raising Standards version to 4.7.2 (no change) * Removing the nocheck annotation for the B-D mockito (Closes: #1116772) -- Pierre Gruet Sat, 04 Oct 2025 22:40:46 +0200 libmina-sshd-java (2.13.2-2) unstable; urgency=medium * Looping over FileStore's instead of using getFileStore(Path), thanks to Pushkar Kulkarni and Santiago Vila! (Closes: #1074355) -- Pierre Gruet Thu, 23 Jan 2025 00:11:22 +0100 libmina-sshd-java (2.13.2-1) unstable; urgency=medium * New upstream version 2.13.2 * Refreshing patches * Adding a versioned B-D on libjsch-java which has switched upstream * Managing test dependencies and test artifacts more thoroughly, using Maven classifiers * Skipping second runs of some tests as some issues have been identified upstream with reruns * Rules-Requires-Root: no in d/control -- Pierre Gruet Sun, 22 Sep 2024 22:40:07 +0200 libmina-sshd-java (2.12.1-2) unstable; urgency=medium * Source-only upload to unstable -- Pierre Gruet Mon, 13 May 2024 20:10:58 +0200 libmina-sshd-java (2.12.1-1) experimental; urgency=medium * Initial release (Closes: #683639) -- Pierre Gruet Mon, 06 May 2024 10:31:16 +0200