CVE-2026-94052

A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks.

Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey authentication on the server side with an LDAP server.

sshd-ldap is an optional component. SSH servers implemented with Apache MINA SSHD are affected only if they use sshd-ldap and do configure an LdapPasswordAuthenticator to be used for password authentication. Normal password authentication via the built-in mechanisms in sshd-core is not affected by this vulnerability, which concerns only LdapPasswordAuthenticator.

Users are recommended to upgrade affected applications to version 2.20.0 or 3.0.0-M6, which fix this issue.

A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks.

Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey authentication on the server side with an LDAP server.

sshd-ldap is an optional component. SSH servers implemented with Apache MINA SSHD are affected only if they use sshd-ldap and do configure an LdapPasswordAuthenticator to be used for password authentication. Normal password authentication via the built-in mechanisms in sshd-core is not affected by this vulnerability, which concerns only LdapPasswordAuthenticator.

Users are recommended to upgrade affected applications to version 2.20.0 or 3.0.0-M6, which fix this issue.

A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks.

Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey authentication on the server side with an LDAP server.

sshd-ldap is an optional component. SSH servers implemented with Apache MINA SSHD are affected only if they use sshd-ldap and do configure an LdapPasswordAuthenticator to be used for password authentication. Normal password authentication via the built-in mechanisms in sshd-core is not affected by this vulnerability, which concerns only LdapPasswordAuthenticator.

Users are recommended to upgrade affected applications to version 2.20.0 or 3.0.0-M6, which fix this issue.

A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks.

Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey authentication on the server side with an LDAP server.

sshd-ldap is an optional component. SSH servers implemented with Apache MINA SSHD are affected only if they use sshd-ldap and do configure an LdapPasswordAuthenticator to be used for password authentication. Normal password authentication via the built-in mechanisms in sshd-core is not affected by this vulnerability, which concerns only LdapPasswordAuthenticator.

Users are recommended to upgrade affected applications to version 2.20.0 or 3.0.0-M6, which fix this issue.

A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey authentication on the server side with an LDAP server. sshd-ldap is an optional component. SSH servers implemented with Apache MINA SSHD are affected only if they use sshd-ldap and do configure an LdapPasswordAuthenticator to be used for password authentication. Normal password authentication via the built-in mechanisms in sshd-core is not affected by this vulnerability, which concerns only LdapPasswordAuthenticator. Users are recommended to upgrade affected applications to version 2.20.0 or 3.0.0-M6, which fix this issue.

A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey authentication on the server side with an LDAP server. sshd-ldap is an optional component. SSH servers implemented with Apache MINA SSHD are affected only if they use sshd-ldap and do configure an LdapPasswordAuthenticator to be used for password authentication. Normal password authentication via the built-in mechanisms in sshd-core is not affected by this vulnerability, which concerns only LdapPasswordAuthenticator. Users are recommended to upgrade affected applications to version 2.20.0 or 3.0.0-M6, which fix this issue.

These are all security issues fixed in the apache-sshd-2.20.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for apache-sshd fixes the following issues:

• CVE-2026-77185: Asynchronous authentication can bypass signature verification (bsc#1283357).
• CVE-2026-93994: Repeated-publickey policy bypass on server (bsc#1283352).
• CVE-2026-93995: Remote execution of JGit 'archive -o=file.zip' can write file on the server (bsc#1283350).
• CVE-2026-93996: Memory exhaustion DoS via unbounded SCP command line read (bsc#1283348).
• CVE-2026-94002: Memory exhaustion in SFTP client via unsolicited SFTP replies (bsc#1283347).
• CVE-2026-94029: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension (bsc#1283346).
• CVE-2026-94052: LDAP password authentication ineffective (bsc#1283345).
• CVE-2026-94053: LDAP injection in sshd-ldap (bsc#1283344).

Changes for apache-sshd:

• Update to upstream version 2.20.0:

• GH-656 ChannelPipedInputStream: shrink buffer when emptied
• GH-906 Fix finding a signature factory for BC ed25519 keys
• GH-911 Fix server-side SOCKS5 proxy for fragmented and pipelined CONNECT requests
• Allow asynchronous authentication only for password and keyboard-interactive authentication schemes
• Fix authentication requiring multiple public keys (server-side)
• Better argument handling in sshd-git
• More checks in authentication (server-side)
• Better SCP command handling
• SFTP client: simplify response message handling
• Fix check-file-name/check-file-handle SFTP v6 extension
• Improve LDAP authentication (sshd-ldap)

• New Features

• GH-905 Implement the 'from' and 'expiry-time' options in authorized_keys handling in public key authentication (server side)