Dilrevx

Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

**Name of the Vulnerable Software and Affected Versions** Apache MINA SSHD versions 1.2.0 through 2.19.0 Apache MINA SSHD versions 3.0.0-M1 through 3.0.0-M5 **Description** A missing check in the `LdapPasswordAuthenticator` function within the `sshd-ldap` component allows attackers to bypass password authentication. This issue specifically affects SSH servers that use the optional `sshd-ldap` component and have configured `LdapPasswordAuthenticator` for password authentication. Standard password authentication provided by the `sshd-core` mechanisms is not affected. **Recommendations** Upgrade Apache MINA SSHD versions 1.2.0 through 2.19.0 to version 2.20.0. Upgrade Apache MINA SSHD versions 3.0.0-M1 through 3.0.0-M5 to version 3.0.0-M6.

**Name of the Vulnerable Software and Affected Versions** Apache MINA SSHD versions 1.2.0 through 2.19.0 Apache MINA SSHD versions 3.0.0-M1 through 3.0.0-M5 **Description** An authentication bypass exists in the optional `sshd-ldap` component, which integrates password and public key authentication with an LDAP server. The issue stems from a lack of escaping for LDAP filter metacharacters, allowing successful authentication by using `*` for both the `username` and `password` variables. **Recommendations** Update Apache MINA SSHD versions 1.2.0 through 2.19.0 to version 2.20.0. Update Apache MINA SSHD versions 3.0.0-M1 through 3.0.0-M5 to version 3.0.0-M6. Restrict the use of the `sshd-ldap` component if it is not required for authentication.