Threats tagged 'ghsa-f2wh-grmh-r6jm'

Apache MINA versions 2.0.0 through 2.0.27, 2.1.0 through 2.1.10, and 2.2.0 through 2.2.5 contain a deserialization vulnerability due to an incomplete fix for CVE-2024-52046. The classname allowlist intended to restrict deserialization was applied too late, allowing unsafe classes to be deserialized. This issue is resolved in versions 2.0.28, 2.1.11, and 2.2.6 by applying the allowlist earlier in the deserialization process. Applications using Apache MINA that invoke IoBuffer.getObject() are affected and should upgrade to the fixed versions.