-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper validation of message integrity during key exchange (CWE-354). The Terrapin attack exploits two gaps: 1) allowing non-KEX_INIT messages during initial key exchange, and 2) not resetting sequence numbers properly. The commits show added strict KEX validation in AbstractSession (6b0fd46) and message handling tests (315739e). The handleMessage() function would have previously processed messages without strict sequence validation, while resetSequenceNumbers() didn't properly maintain counter integrity. These functions are central to the KEX message flow and were explicitly modified in the patch to add strict validation checks.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.sshd:sshd-common | maven | < 2.12.0 | 2.12.0 |