You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@mina.apache.org by Emmanuel Lecharny <el...@apache.org> on 2019/04/14 06:30:01 UTC

[CVE-2019-0231] MINA SSLFilter security Issue

Description: Handling of the close_notify SSL/TLS message does not
lead to a connection closure, leading the server to retain the socket
opened and to have the client potentially receive clear-text messages
which were supposed to be encrypted.

This security issue is fixed by Apache MINA 2.0.21 or Apache MINA
2.0.21. Please migrate to those new versions.

-- 
Regards,
Cordialement,
Emmanuel Lécharny
www.iktek.com