libmina-sshd-java (2.20.1-1) unstable; urgency=medium

  * New upstream version 2.20.1:
    Fixes the following CVE:
    - CVE-2026-77185:
    Authentication bypass in sshd-core in Apache MINA SSHD versions
    2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (presumed
    rare) way to implement an SSH server.     Apache MINA SSHD is a Java
    library for client- and server-side SSH. In the server part of the
    library, a mechanism to perform "asynchronous authentication"
    exists. A server implemented with Apache MINA SSHD must contain
    explicit code to make use of this feature. The implementation of
    this feature was flawed and could potentially lead to skipping
    checking the signature in public-key or hostbased authentication, or
    returning a wrong result.
    - CVE-2026-93994:
    Apache MINA SSHD is a Java library for client-side and server-side
    SSH. SSH servers can be configured to require multi-authentication
    schemes, for instance two different public keys, not just one. In
    OpenSSH, this would be done by setting in sshd_config
    AuthenticationMethods "publickey,publickey". Apache MINA SSHD
    provides an equivalent configuration mechanism.     In Apache MINA
    SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code
    in component sshd-core does not enforce that the two public keys
    presented are different. A user can thus successfully authenticate
    with only one of the two key pairs required by presenting this
    single key twice. This is a partial authentication bypass.
    - CVE-2026-93995:
    Improper input validation in sshd-git in Apache MINA SSHD, versions
    up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache  MINA SSHD is a Java
    library for client-side and server-side SSH.     Component
    org.apache.sshd:sshd-git provides though class GitPgmCommandFactory
    a way to configure an Apache MINA SSHD server such  that
    authenticated SSH clients can remotely execute git commands via the
    JGit library  on git repositories stored on the server.
    In CVE-2026-58624 this mechanism was restricted to only a few git
    commands, including "git archive" without "--output" or "-o" options
    such that the resulting archive would not be written on the server
    but instead sent back to the client over the SSH connection.     The
    fix done for CVE-2026-58624 was insufficient as it missed removing
    the single-argument "-o=file.zip" version of the command
    parameter from the "archive" command.
    - CVE-2026-93996:
    Uncontrolled resource consumption in component ssd-scp in Apache
    MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA
    SSHD is a Java library for client-side and server-side SSH.
    Component sshd-scp of Apache MINA SSHD provides a Java
    implementation of SCP. The SCP command protocol is line-oriented
    with LF-terminated lines. The protocol handler in sshd-scp did not
    impose any limit on the length of such protocol lines. A malicious
    peer just sending a junk command containing a never-ending sequence
    of characters but never a LF would cause the receiver to allocate
    memory to store this whole junk command, exhausting memory and
    crashing the application with an OutOfMemoryError.
    - CVE-2026-94002:
    Possible memory exhaustion in SFTP clients (DefaultSftpClient) in
    component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and
    3.0.0-M1 to 3.0.0-M5.     Apache  MINA SSHD is a Java library for
    client-side and server-side SSH. The sshd-sftp component provides
    support for SFTP.     The SFTP client implementation, when receiving
    a reply, did not check that this reply corresponded to a request
    sent earlier. Unsolicited replies would be stored but never
    consumed. A malicious server could keep sending unsolicited replies
    until available memory in the client was exhausted.
    - CVE-2026-94029:
    Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0
    and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-
    file-name/check-file-handle extension. Apache MINA SSHD is a Java
    library for client-side and server-side SSH.     Using a very small
    "block size" (for instance 256, which is the minimum) on a huge file
    generates many (file size / block size) hashes. The resulting SFTP
    reply message was accumulated fully in memory server-side, which
    could, with a suitably large (possibly sparse) file exhaust the
    server-side memory, taking down the server.
    - CVE-2026-94052:
    A missing check in LdapPasswordAuthenticator in component sshd-ldap
    in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5
    bypassed authentication checks.     Apache MINA SSHD is a Java
    library for client-side and server-side SSH. The optional sshd-ldap
    component provides support for integrating password and publickey
    authentication on the server side with an LDAP server.     sshd-ldap
    is an optional component. SSH servers implemented with Apache MINA
    SSHD are affected only if they use sshd-ldap and do configure an
    LdapPasswordAuthenticator to be used for password authentication.
    Normal password authentication via the built-in mechanisms in sshd-
    core is _not_ affected by this vulnerability, which concerns only
    LdapPasswordAuthenticator.
    - CVE-2026-94053:
    Authentication bypass via LDAP injection in component sshd-ldap in
    Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.
    Apache MINA SSHD is a Java library for client-side and server-side
    SSH.  The optional sshd-ldap component provides support for
    integrating  password and publickey authentication on the server
    side with an LDAP  server.     sshd-ldap is an optional component.
    SSH servers implemented with Apache  MINA SSHD are affected only if
    they use sshd-ldap and do configure it to be used for password of
    public key authentication.  Other Apache MINA SSHD servers are not
    affected.     Lack of escaping LDAP filter metacharacters enabled
    successful authentication with username "*" and password "*".
    (Closes: #1149652)
  * Refreshing patches

 -- Pierre Gruet <pgt@debian.org>  Thu, 05 Nov 2026 11:01:37 +0100

libmina-sshd-java (2.19.0-1) unstable; urgency=medium

  * New upstream version 2.19.0:
    Fixes the following CVE:
    - CVE-2026-48827:
    Path traversal vulnerability in Apache MINA SSHD bundle sshd-git.
    Lack of path validation in git-upload-pack, git-receive-pack, and
    other git operations allows users authenticated over SSH access to
    git repositories outside the configured git server root directory.
    Applications are affected if they use org.apache.sshd:sshd-git.
    Applications not using sshd-git are not affected.
    - CVE-2026-56452:
    Path traversal in the sshd-scp component of Apache MINA SSHD. Apache
    MINA SSHD is a Java library for client-side and server-side SSH.
    The implementation of receiving files or directories via SCP did not
    validate filenames in SCP "C" or "D" commands. A malicious sender
    could send filenames containing paths, resulting in files to be
    written in attacker-controlled places.
    - CVE-2026-56624:
    Improper certificate validation in Apache MINA SSHD (server-
    side). Apache MINA SSHD is a Java library for client-side and
    server-side SSH.     Server-side OpenSSH user certificate validation
    during user authentication in an Apache MINA SSHD server did not
    check for the unsupported force-command or verify-required options
    that could be embedded in the certificate, nor did it validate these
    options. As a result it was possible that a user could authenticate
    with such a certificate that included a force-command option but
    still was able to execute other commands. What other command exactly
    would be available to the user depends on the implementation of the
    server.
    - CVE-2026-58624:
    Improper input validation in sshd-git in Apache MINA SSHD. Apache
    MINA SSHD is a Java library for client-side and server-side SSH.
    Component org.apache.sshd:sshd-git provides though its
    GitPgmCommandFactory a way to configure an Apache MINA SSHD server
    such that SSH clients can remotely execute git commands via the JGit
    library on git repositories stored on the server.     This
    GitPgmCommandFactory allowed a user authenticated via SSH to run any
    JGit command available, including commands that could write files at
    arbitrary places such as git archive with the --output option.
    Affected are SSH servers implemented with Apache MINA SSHD and using
    the GitPgmCommandFactory. If the GitPgmCommandFactory is not
    configured on the server, the server is not affected.
    (Closes: #1138634, #1142679)
  * Refreshing patches
  * Switching to debhelper-compat 14, removing misc: substvar
  * Raising Standards version to 4.7.4:
    - Removing Priority: optional, which is now defaults
    - Removing R-R-R: no, which is now defaults
  * Raising d/watch version to 5
  * Skipping second and identical run of tests with mina 2.2.x
  * Skipping additional classpath requirements of bouncycastle fips classes
  * B-D on junit5
  * Updating versioned B-D on libapacheds-java
  * Updating the list of POM files
  * Patching out more tests requiring unpackaged org.testcontainers

 -- Pierre Gruet <pgt@debian.org>  Wed, 04 Nov 2026 21:31:50 +0100

libmina-sshd-java (2.13.2-3) unstable; urgency=medium

  * Raising Standards version to 4.7.2 (no change)
  * Removing the nocheck annotation for the B-D mockito (Closes: #1116772)

 -- Pierre Gruet <pgt@debian.org>  Sat, 04 Oct 2025 22:40:46 +0200

libmina-sshd-java (2.13.2-2) unstable; urgency=medium

  * Looping over FileStore's instead of using getFileStore(Path), thanks to
    Pushkar Kulkarni and Santiago Vila! (Closes: #1074355)

 -- Pierre Gruet <pgt@debian.org>  Thu, 23 Jan 2025 00:11:22 +0100

libmina-sshd-java (2.13.2-1) unstable; urgency=medium

  * New upstream version 2.13.2
  * Refreshing patches
  * Adding a versioned B-D on libjsch-java which has switched upstream
  * Managing test dependencies and test artifacts more thoroughly, using
    Maven classifiers
  * Skipping second runs of some tests as some issues have been identified
    upstream with reruns
  * Rules-Requires-Root: no in d/control

 -- Pierre Gruet <pgt@debian.org>  Sun, 22 Sep 2024 22:40:07 +0200

libmina-sshd-java (2.12.1-2) unstable; urgency=medium

  * Source-only upload to unstable

 -- Pierre Gruet <pgt@debian.org>  Mon, 13 May 2024 20:10:58 +0200

libmina-sshd-java (2.12.1-1) experimental; urgency=medium

  * Initial release (Closes: #683639)

 -- Pierre Gruet <pgt@debian.org>  Mon, 06 May 2024 10:31:16 +0200
