CVE-2022-45047
published 2022-11-16CVE-2022-45047: Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized…
PriorityP355critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
3.57%
88.0th percentile
Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | sshd | <= 2.9.1 | — |
| apache_software_foundation | apache_mina_sshd | unspecified – 2.9.1 | — |
| debian | libmina-sshd-java | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_debian9.8LOW
vendor_oracle9.8CRITICAL
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Analytics Risk Matrix: Core (Apache Mina SSHD) — CVE-2022-45047
vendor_oracle·2026-01-15·CVSS 7.2
CVE-2022-45047 [CRITICAL] Oracle Oracle Analytics Risk Matrix: Core (Apache Mina SSHD) — CVE-2022-45047
Oracle Oracle Analytics Risk Matrix: Core (Apache Mina SSHD) vulnerability
CVE: CVE-2022-45047
CVSS: 7.2
Protocol: SSH
Remote exploit: No
Affected versions: Network
Advisory: cpujan2026 (JAN 2026)
Oracle
Oracle Oracle Enterprise Manager Risk Matrix: Agent Next Gen (Apache Mina SSHD) — CVE-2022-45047
vendor_oracle·2025-04-15·CVSS 9.8
CVE-2022-45047 [CRITICAL] Oracle Oracle Enterprise Manager Risk Matrix: Agent Next Gen (Apache Mina SSHD) — CVE-2022-45047
Oracle Oracle Enterprise Manager Risk Matrix: Agent Next Gen (Apache Mina SSHD) vulnerability
CVE: CVE-2022-45047
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2025 (APR 2025)
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: core module (Apache Mina SSHD) — CVE-2022-45047
vendor_oracle·2023-07-15·CVSS 9.8
CVE-2022-45047 [CRITICAL] Oracle Oracle Financial Services Applications Risk Matrix: core module (Apache Mina SSHD) — CVE-2022-45047
Oracle Oracle Financial Services Applications Risk Matrix: core module (Apache Mina SSHD) vulnerability
CVE: CVE-2022-45047
CVSS: 9.8
Protocol: SSH
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2023 (JUL 2023)
Oracle
Oracle Oracle Communications Risk Matrix: BEServer (Apache Mina SSHD) — CVE-2022-45047
vendor_oracle·2023-04-15·CVSS 9.8
CVE-2022-45047 [CRITICAL] Oracle Oracle Communications Risk Matrix: BEServer (Apache Mina SSHD) — CVE-2022-45047
Oracle Oracle Communications Risk Matrix: BEServer (Apache Mina SSHD) vulnerability
CVE: CVE-2022-45047
CVSS: 9.8
Protocol: SSH
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2023 (APR 2023)
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: RDA - Remote Diagnostic Agent (Apache Mina SSHD) — CVE-2022-45047
vendor_oracle·2023-01-15·CVSS 9.8
CVE-2022-45047 [CRITICAL] Oracle Oracle Fusion Middleware Risk Matrix: RDA - Remote Diagnostic Agent (Apache Mina SSHD) — CVE-2022-45047
Oracle Oracle Fusion Middleware Risk Matrix: RDA - Remote Diagnostic Agent (Apache Mina SSHD) vulnerability
CVE: CVE-2022-45047
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2023 (JAN 2023)
Red Hat
mina-sshd: Java unsafe deserialization vulnerability
vendor_redhat·2022-11-16·CVSS 9.8
CVE-2022-45047 [CRITICAL] CWE-502 mina-sshd: Java unsafe deserialization vulnerability
mina-sshd: Java unsafe deserialization vulnerability
Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server.
A flaw was found in Apache MINA SSHD, when using Java deserialization to load a serialized java.security.PrivateKey. An attacker could benefit from unsafe deserialization by inserting unsecured data that may affect the application or server.
Statement: Red Hat Impact as High as there's a mitigation for minimizing the impact which the flaw requires org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to be impact
Debian
CVE-2022-45047: libmina-sshd-java - Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apach...
vendor_debian·2022·CVSS 9.8
CVE-2022-45047 [CRITICAL] CVE-2022-45047: libmina-sshd-java - Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apach...
Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server.
Scope: local
forky: resolved
sid: resolved
trixie: resolved
OSV
Unsafe deserialization in Apache MINA SSHD
osv·2022-11-16
CVE-2022-45047 [CRITICAL] Unsafe deserialization in Apache MINA SSHD
Unsafe deserialization in Apache MINA SSHD
Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server.
Until version 2.1.0, the code affected by this vulnerability appeared in `org.apache.sshd:sshd-core`. Version 2.1.0 contains a [commit](https://github.com/apache/mina-sshd/commit/10de190e7d3f9189deb76b8d08c72334a1fe2df0) where the code was moved to the package `org.apache.sshd:sshd-common`, which did not exist until version 2.1.0.
GHSA
Unsafe deserialization in Apache MINA SSHD
ghsa·2022-11-16
CVE-2022-45047 [CRITICAL] CWE-502 Unsafe deserialization in Apache MINA SSHD
Unsafe deserialization in Apache MINA SSHD
Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server.
Until version 2.1.0, the code affected by this vulnerability appeared in `org.apache.sshd:sshd-core`. Version 2.1.0 contains a [commit](https://github.com/apache/mina-sshd/commit/10de190e7d3f9189deb76b8d08c72334a1fe2df0) where the code was moved to the package `org.apache.sshd:sshd-common`, which did not exist until version 2.1.0.
No detection rules found.
No public exploits indexed.
Qualys
Oracle Critical Patch Update, April 2026 Security Update Review
blogs_qualys·2026-04-22
CVE-2025-6965 Oracle Critical Patch Update, April 2026 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Oracle released its second quarterly edition of this year’s Critical Patch Update. The update received patches for 481 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 139, constituting about 28% of the total patches released. Oracle Financial Services Applications and Oracle Fusion Middleware followed, with 75 and 59 security patches.
376 of the 481 security patches provided by the April Critical Patch Update (about 78%)
Qualys
Oracle Patch Tuesday, July 2023 Security Update Review
blogs_qualys·2023-07-19
Oracle Patch Tuesday, July 2023 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response with Patch Management (PM)
Oracle has released its third quarterly edition of Critical Patch Update, which contains a group of patches for 508 security vulnerabilities. Some of the vulnerabilities addressed this month impact more than one product. These patches address vulnerabilities in Oracle code and third-party components included in Oracle products.
During Q3 2023 Oracle Critical Patch Update, the Oracle Financial Services Applications received the highest number of 147 patches, constituting 29% of the total patches released. Oracle Communications and Oracle Fusion Middleware followed, with
Qualys
Oracle Patch Tuesday, July 2023 Security Update Review | Qualys
blogs_qualys·2023-07-19
Oracle Patch Tuesday, July 2023 Security Update Review | Qualys
#### Table of Contents
- Qualys QID Coverage
- Notable Oracle Vulnerabilities Patched
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response with Patch Management (PM)
Oracle has released its third quarterly edition of Critical Patch Update, which contains a group of patches for 508 security vulnerabilities. Some of the vulnerabilities addressed this month impact more than one product. These patches address vulnerabilities in Oracle code and third-party components included in Oracle products.
During Q3 2023 Oracle Critical Patch Update, the Oracle Financial Services Applications received the highest number of 147 patches, constituting 29% of the total patches released. Oracle Communications and Oracle Fusion Middleware followe
Qualys
Oracle Security Updates: Critical Patch April 2023 Advisory | Qualys
blogs_qualys·2023-04-19
Oracle Security Updates: Critical Patch April 2023 Advisory | Qualys
#### Table of Contents
- Qualys QID Coverage
- Notable Oracle Vulnerabilities Patched
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response with Patch Management (PM)
Oracle has released the second quarterly edition of Critical Patch Update, which contains a group of patches for 433 security vulnerabilities. Some of the vulnerabilities addressed this month impact various products. These patches address vulnerabilities in Oracle code and third-party components included in Oracle products.
During Q2 2023 Oracle Critical Patch Update, the Oracle Communications product suite recorded the highest number of patches at 77, constituting 17% of the total patches released. The Oracle Financial Services Applications and Oracle Fusion Mi
Qualys
Oracle Patch Tuesday April 2023 Security Update Review
blogs_qualys·2023-04-19
Oracle Patch Tuesday April 2023 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response with Patch Management (PM)
Oracle has released the second quarterly edition of Critical Patch Update, which contains a group of patches for 433 security vulnerabilities. Some of the vulnerabilities addressed this month impact various products. These patches address vulnerabilities in Oracle code and third-party components included in Oracle products.
During Q2 2023 Oracle Critical Patch Update, the Oracle Communications product suite recorded the highest number of patches at 77, constituting 17% of the total patches released. The Oracle Financial Services Applications and Oracle Fusion Middlewar
2022-11-16
Published