Executive brief
jsch is a Java library used for SSH client functionality in applications. A flaw in the certificate revocation checking mechanism could allow an attacker to bypass revocation validation when connecting to hosts, potentially enabling the use of compromised or revoked host keys in SSH connections.
Technical details
The vulnerability is an improper validation issue in the getRevokedKeys function of KnownHosts.java, where certificate-form revoked host keys are not properly parsed. The flaw occurs when a maliciously crafted known_hosts argument is provided, resulting in a failure to properly check for certificate revocation. The attack requires network reachability and direct control over the known_hosts input. An attacker can exploit this to bypass revocation checks on host certificates. The fix is available in version 2.28.6 (commit 194a2f76a5c0f1c3f778565be3fd66bcafc42d23).
Affected products
- mwiede jsch up to 2.28.5
Timeline
- 2026-09-06: disclosed
- 2026-07-29: patched: Fixed in version 2.28.6 via commit 194a2f76a5c0f1c3f778565be3fd66bcafc42d23