Threats tagged 'ghsa-995c-6rp3-4m4x'

Apache MINA versions 2.1.0 through 2.1.11 and 2.2.0 through 2.2.6 are vulnerable to deserialization of untrusted data due to an incomplete fix for a previous vulnerability (CVE-2024-52046). The classname allowlist intended to restrict deserialization was applied too late, allowing unsafe deserialization to occur. This issue is resolved in versions 2.1.12 and 2.2.7 by applying the allowlist earlier in the deserialization process. Applications using Apache MINA that call IoBuffer.getObject() should upgrade to the fixed versions to mitigate this critical vulnerability.