CyberRota Analysis
AI-GeneratedA vulnerability exists in the Java library mwiede jsch versions up to 2.28.5, specifically in the getRevokedKeys function, which improperly checks for certificate revocation due to manipulated known_hosts arguments. While the severity is low and the exploit is complex and difficult to execute, organizations using this library should prioritize upgrading to version 2.28.6 to mitigate potential remote attacks, especially if they handle sensitive data or rely on secure communications.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument known_hosts results in improper check for certificate revocation. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.28.6 is able to address this issue. The patch is named 194a2f76a5c0f1c3f778565be3fd66bcafc42d23. You should upgrade the affected component.