CVE-2019-0231: Cleartext Transmission of Sensitive Information in Apache MINA
Summary
CVE-2019-0231: Cleartext Transmission of Sensitive Information in Apache MINA. Affects org.apache.mina:mina-core across 2 version ranges.
< 2.0.21
>= 2.1.0, < 2.1.1
Fixed in 2.0.21 or 2.1.1, depending on the release line you run. How to fix ↓
Also tracked for
- mina · Debian:11
The same CVE-2019-0231 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache MINA is a Java network application framework that provides a high-level API for building scalable and efficient network applications. It is commonly used for developing server-side applications that require network communication. The vulnerability identified as CVE-2019-0231 affects the Apache MINA library.
Vulnerability Detail
The vulnerability arises from the mishandling of the close_notify SSL/TLS message, which fails to close the connection properly. As a result, the server retains the socket open, potentially allowing the client to receive clear text messages after the SSL/TLS connection is terminated. This can lead to the exposure of sensitive information transmitted over the network. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.0.212.0.21 -
>= 2.1.0, < 2.1.12.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the available patches or upgrade to the fixed versions as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in Apache MINA can lead to the transmission of sensitive information in clear text, posing a security risk to network communication. To mitigate this issue, users should upgrade to the patched versions or apply the available patches. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.mina:mina-core →
FAQ
Apache MINA is a Java network application framework used for building scalable and efficient network applications.
The vulnerability allows for the potential transmission of sensitive information in clear text, compromising the security of the network communication.
The vulnerability has a CVSS score of 7.5, indicating a high severity level.
To fix this vulnerability, users should upgrade their Apache MINA version to the patched releases: 2.0.21 for 2.0.20 users and 2.1.1 for 2.1.0 users.
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the available patches or upgrade to the fixed versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.mina:mina-core.
