GHSA-5h29-qq92-wj7f

Suggest an improvement
Source
https://github.com/advisories/GHSA-5h29-qq92-wj7f
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-5h29-qq92-wj7f/GHSA-5h29-qq92-wj7f.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-5h29-qq92-wj7f
Aliases
Published
2022-05-24T16:57:28Z
Modified
2023-11-01T04:49:45.081574Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Cleartext Transmission of Sensitive Information in Apache MINA
Details

Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2.0.21, 2.1.0 users should migrate to 2.1.1. This issue affects: Apache MINA.

Database specific
{
    "nvd_published_at": "2019-10-01T20:15:00Z",
    "github_reviewed_at": "2022-06-29T15:48:56Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-319"
    ]
}
References

Affected packages

Maven / org.apache.mina:mina-core

Package

Name
org.apache.mina:mina-core
View open source insights on deps.dev
Purl
pkg:maven/org.apache.mina/mina-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.0.21

Affected versions

1.*

1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.0.10
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7

2.*

2.0.0-M1
2.0.0-M2
2.0.0-M3
2.0.0-M4
2.0.0-M5
2.0.0-M6
2.0.0-RC1
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
2.0.18
2.0.19
2.0.20

Database specific

{
    "last_known_affected_version_range": "<= 2.0.20"
}

Maven / org.apache.mina:mina-core

Package

Name
org.apache.mina:mina-core
View open source insights on deps.dev
Purl
pkg:maven/org.apache.mina/mina-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.1.0
Fixed
2.1.1

Affected versions

2.*

2.1.0