[MAVEN:GHSA-5H29-QQ92-WJ7F] Cleartext Transmission of Sensitive Information in Apache MINA

Severity High

Affected Packages 2

Fixed Packages 2

CVEs 1

Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2.0.21, 2.1.0 users should migrate to 2.1.1. This issue affects: Apache MINA.

Package	Affected Version
pkg:maven/org.apache.mina/mina-core	= 2.1.0
pkg:maven/org.apache.mina/mina-core	<= 2.0.20

Package	Fixed Version
pkg:maven/org.apache.mina/mina-core	= 2.1.1
pkg:maven/org.apache.mina/mina-core	= 2.0.21

ID: MAVEN:GHSA-5H29-QQ92-WJ7F
Severity: high
URL: https://github.com/advisories/GHSA-5h29-qq92-wj7f
Published: 2022-05-24T16:57:28
(2 years ago)
Modified: 2023-01-27T05:02:38
(20 months ago)
Rights: Maven Security Team

Source	# ID	Name	URL
			https://nvd.nist.gov/vuln/detail/CVE-2019-0231
			http://mina.apache.org/mina-project/index.html#mina-211-mina-2021-released-posted-on-april-14-2019
			https://github.com/advisories/GHSA-5h29-qq92-wj7f

Type	Package URL	Namespace	Name / Product	Version
Affected	pkg:maven/org.apache.mina/mina-core	org.apache.mina	mina-core	= 2.1.0
Fixed	pkg:maven/org.apache.mina/mina-core	org.apache.mina	mina-core	= 2.1.1
Affected	pkg:maven/org.apache.mina/mina-core	org.apache.mina	mina-core	<= 2.0.20
Fixed	pkg:maven/org.apache.mina/mina-core	org.apache.mina	mina-core	= 2.0.21

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date