Skip to content
Heist/ feed
Back to feed
MediumFix available

Lightwell Security Advisory: jsch 0.2.1.rhlw-00004

Type: advisorySources: OSV

Red Hat Lightwell has released com.github.mwiede:jsch 0.2.1.rhlw-00004 with a backported security fix. CVE-2023-48795: The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10

Products
com.github.mwiede:jsch
Affected versions
0.1.56, 0.1.57, 0.1.58, 0.1.59, 0.1.60, 0.1.61, 0.1.62, 0.1.63, 0.1.64, 0.1.65, 0.1.66, 0.1.67, 0.1.68, 0.1.69, 0.1.70, 0.1.71, 0.1.72, 0.2.0, 0.2.1
Fixed versions
0.2.1.rhlw-00004
CVEs
CVE-2023-48795
Confirmed fixed CVEs
Not specified
Updated in this feed
1 Nov 2026, 17:14 UTC · Revision 1

Source evidence

Lightwell Security Advisory: jsch 0.2.1.rhlw-00004

core-osv · Original source

Published 31 Aug 2026, 13:36 UTC

Red Hat Lightwell has released com.github.mwiede:jsch 0.2.1.rhlw-00004 with a backported security fix. CVE-2023-48795: The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10

osv:RHLW-2026-d0749bc5ef98b166

com.github.mwiede:jsch

Fixed versions: 0.2.1.rhlw-00004

Complete source record
{
  "id": "5cb150534f5b2866f47981de796712cf2ebf242a3573d875d555a5ae5123ac1a",
  "url": "https://osv.dev/vulnerability/RHLW-2026-d0749bc5ef98b166",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Lightwell Security Advisory: jsch 0.2.1.rhlw-00004",
    "summary": "Red Hat Lightwell has released com.github.mwiede:jsch 0.2.1.rhlw-00004 with a backported security fix. CVE-2023-48795: The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10",
    "evidence": "osv:RHLW-2026-d0749bc5ef98b166",
    "products": [
      {
        "name": {
          "value": "com.github.mwiede:jsch",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.2.1.rhlw-00004",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": [
          {
            "value": "0.1.56",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.1.57",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.1.58",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.1.59",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.1.60",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.1.61",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.1.62",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.1.63",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.1.64",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.1.65",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.1.66",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.1.67",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.1.68",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.1.69",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.1.70",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.1.71",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.1.72",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.2.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.2.1",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "RHLW-2026-d0749bc5ef98b166",
      "aliases": [
        "RHLW-2026-d0749bc5ef98b166"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.2.1.rhlw-00004"
                }
              ]
            }
          ],
          "package": {
            "name": "com.github.mwiede:jsch",
            "purl": "pkg:maven/com.github.mwiede/jsch",
            "ecosystem": "Red Hat Lightwell:Maven"
          },
          "versions": [
            "0.1.56",
            "0.1.57",
            "0.1.58",
            "0.1.59",
            "0.1.60",
            "0.1.61",
            "0.1.62",
            "0.1.63",
            "0.1.64",
            "0.1.65",
            "0.1.66",
            "0.1.67",
            "0.1.68",
            "0.1.69",
            "0.1.70",
            "0.1.71",
            "0.1.72",
            "0.2.0",
            "0.2.1"
          ],
          "database_specific": {
            "source": "https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-d0749bc5ef98b166.json",
            "lightwell": {
              "repository_url": "https://packages.redhat.com/lightwell/java/remediated/",
              "remediated_version": "0.2.1.rhlw-00004",
              "backport_base_version": "0.2.1"
            }
          }
        }
      ],
      "modified": "2026-10-27T04:00:19.543840952Z",
      "provider": "osv",
      "upstream": [
        "CVE-2023-48795",
        "GHSA-45x7-px36-x8w8"
      ],
      "references": [
        "https://access.redhat.com/security/cve/cve-2023-48795",
        "https://github.com/PowerShell/Win32-OpenSSH/releases/tag/v9.5.0.0p1-Beta",
        "https://github.com/TeraTermProject/teraterm/releases/tag/v5.1",
        "https://github.com/connectbot/sshlib/compare/2.2.21...2.2.22",
        "https://github.com/drakkan/sftpgo/releases/tag/v2.5.6",
        "https://github.com/erlang/otp/blob/d1b43dc0f1361d2ad67601169e90a7fc50bb0369/lib/ssh/doc/src/notes.xml#L39-L42",
        "https://github.com/erlang/otp/releases/tag/OTP-26.2.1",
        "https://github.com/mkj/dropbear/blob/17657c36cce6df7716d5ff151ec09a665382d5dd/CHANGES#L25",
        "https://github.com/mwiede/jsch/compare/jsch-0.2.14...jsch-0.2.15",
        "https://github.com/net-ssh/net-ssh/blob/2e65064a52d73396bfc3806c9196fc8108f33cd8/CHANGES.txt#L14-L16",
        "https://github.com/openssh/openssh-portable/commits/master",
        "https://github.com/proftpd/proftpd/blob/0a7ea9b0ba9fcdf368374a226370d08f10397d99/RELEASE_NOTES",
        "https://github.com/proftpd/proftpd/blob/d21e7a2e47e9b38f709bec58e3fa711f759ad0e1/RELEASE_NOTES",
        "https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES",
        "https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst",
        "https://github.com/ronf/asyncssh/tags",
        "https://github.com/warp-tech/russh/releases/tag/v0.40.2",
        "https://gitlab.com/libssh/libssh-mirror/-/tags",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48795.json",
        "https://github.com/advisories/GHSA-45x7-px36-x8w8",
        "https://nvd.nist.gov/vuln/detail/CVE-2023-48795",
        "https://github.com/PowerShell/Win32-OpenSSH/issues/2189",
        "https://github.com/apache/mina-sshd/issues/445",
        "https://github.com/cyd01/KiTTY/issues/520",
        "https://github.com/hierynomus/sshj/issues/916",
        "https://github.com/janmojzis/tinyssh/issues/81",
        "https://github.com/mwiede/jsch/issues/457",
        "https://github.com/paramiko/paramiko/issues/2337",
        "https://github.com/proftpd/proftpd/issues/456",
        "https://github.com/ssh-mitm/ssh-mitm/issues/165",
        "https://github.com/NixOS/nixpkgs/pull/275249",
        "https://github.com/TeraTermProject/teraterm/commit/7279fbd6ef4d0c8bdd6a90af4ada2899d786eec0",
        "https://github.com/connectbot/sshlib/commit/5c8b534f6e97db7ac0e0e579331213aa25c173ab",
        "https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d",
        "https://github.com/jtesta/ssh-audit/commit/8e972c5e94b460379fe0c7d20209c16df81538a5",
        "https://github.com/libssh2/libssh2/pull/1291",
        "https://github.com/mscdex/ssh2/commit/97b223f8891b96d6fc054df5ab1d5a1a545da2a3",
        "https://github.com/mwiede/jsch/pull/461",
        "https://github.com/rapier1/hpn-ssh/releases"
      ]
    },
    "related_cves": [
      {
        "value": "CVE-2023-48795",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 460151,
  "published_at": "2026-08-31T13:36:01+00:00"
}