Description
In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache MINA | Apache MINA – < 2.1.5 | 2.1.5 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mina2 | 2.1.5-1 | — |
| Debian 13 | mina2 | 2.1.5-1 | — |
| Debian 12 | mina2 | 2.1.5-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | mina +1 | No fix yet | — |
| Ubuntu 18.04 LTS | mina2 | No fix yet | — |
| Ubuntu 16.04 LTS | mina2 | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.mina:mina-core | >= 2.1.0, < 2.1.5 | 2.1.5 | GHSA-6mcm-j9cj-3vc3 |
| Maven | org.apache.mina:mina-core | < 2.0.22 | 2.0.22 | GHSA-6mcm-j9cj-3vc3 |
Advisories 1
- WID-SEC-2023-1034 Oracle JD Edwards: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 18, 2023
References
- https://lists.apache.org/thread.html/r0b907da9340d5ff4e6c1a4798ef4e79700a668657f27cca8a39e9250%40%3Cdev.mina.apache.org%3E
- [oss-security] 20211101 [ANNOUNCE] Apache MINA 2.0.22 & 2.1.5 released mailing-list
- [oss-security] 20211101 CVE-2021-41973: Apache MINA HTTP listener DOS mailing-list
- https://www.oracle.com/security-alerts/cpuapr2022.html