This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/mina-site.git
The following commit(s) were added to refs/heads/asf-site by this push:
new 9a0bc0f17 Updated site from master
(405c64d490591f54d560e5b049a432ee05b8769b)
9a0bc0f17 is described below
commit 9a0bc0f170c04e2d9742df20f72e943bcc1bdde6
Author: jenkins <[email protected]>
AuthorDate: Fri Jul 31 16:02:09 2026 +0000
Updated site from master (405c64d490591f54d560e5b049a432ee05b8769b)
---
content/index.xml | 2 +-
content/mina-project/index.html | 12 ++++++------
content/mina-project/index.xml | 2 +-
content/mina-project/news.html | 12 ++++++------
.../technical-documentation/ssl-tls-internal.html | 10 +++++++---
content/sitemap.xml | 6 +++---
6 files changed, 24 insertions(+), 20 deletions(-)
diff --git a/content/index.xml b/content/index.xml
index 4bdda8f92..2234595c1 100644
--- a/content/index.xml
+++ b/content/index.xml
@@ -1992,7 +1992,7 @@ Apache MINA is often called:
<description>News MINA 2.1.15 and 2.1.31 released posted on June, 27
2026 The MINA project is pleased to announce the MINA 2.1.15 and 2.0.31
releases.
This is a bug fix release: A fix for CVE-2026-47065 (&ldquo;Critical
Deserialization Allow-list Bypass via resolveProxyClass&rdquo;)
hasn&rsquo;t been backported to these two version.
Many thanks to tonghuaroot who have reported this mistake.
-Versions affected These issues affects MINA core versions prior to 2.1.15 and
2.0.31
+Affected versions These issues affects MINA core versions prior to 2.1.15 and
2.0.31
Mitigation Those who used the versions 2.</description>
</item>
diff --git a/content/mina-project/index.html b/content/mina-project/index.html
index 9fcdf3f82..d27dd9e96 100644
--- a/content/mina-project/index.html
+++ b/content/mina-project/index.html
@@ -140,15 +140,15 @@
<p>The MINA project is pleased to announce the MINA 2.1.15 and 2.0.31
releases.</p>
<p>This is a bug fix release: A fix for CVE-2026-47065 (“Critical
Deserialization Allow-list Bypass via resolveProxyClass”) hasn’t
been backported to these two version.</p>
<p>Many thanks to <strong>tonghuaroot</strong> who have reported this
mistake.</p>
-<h2 id="versions-affected">Versions affected</h2>
+<h2 id="affected-versions">Affected versions</h2>
<p>These issues affects <strong>MINA</strong> core versions prior to 2.1.15
and 2.0.31</p>
<h2 id="mitigation">Mitigation</h2>
<p>Those who used the versions 2.2.14, 2.0.30 and prior have to upgrade.</p>
-<h2 id="mina-228-2114-2030-released-_posted-on-june-19-2026_">MINA 2.2.8,
2.1.14, 2.0.30 released <em>posted on June, 19 2026</em></h2>
-<p>The MINA project is pleased to announce the MINA 2.2.8, 2.1.14 and 2.0.30
releases.</p>
+<h2 id="mina-229-2114-2030-released-_posted-on-june-19-2026_">MINA 2.2.9,
2.1.14, 2.0.30 released <em>posted on June, 19 2026</em></h2>
+<p>The MINA project is pleased to announce the MINA 2.2.9, 2.1.14 and 2.0.30
releases.</p>
<p>This is a bug fix release: the last release was supposed to fix the
Compression Filter, and it does, to some extent, except that a copy/paste made
it so that the deflater became actually an inflater. The unit test for this
feature has been… commented (due to a Mock library migration that
didn’t go well, and it was expected to be temporary), so all the tests
passed green. Wrongly…</p>
<p>Bottom line thanks to Jörg Michelberger who accuratly reviewed the code, we
were made aware of this mistake, and decided to cut this release ASAP.</p>
-<h2 id="versions-affected-1">Versions affected</h2>
+<h2 id="affected-versions-1">Affected versions</h2>
<p>These issues affects <strong>MINA</strong> core versions 2.2.8, 2.1.13 and
2.0.29 and none of the previous versions</p>
<h2 id="mitigation-1">Mitigation</h2>
<p>Those who used the previous version 2.2.8, 2.1.13, 2.0.29 and using the
compression filter have to upgrade.</p>
@@ -230,7 +230,7 @@ potentially leading to remote code execution
(<strong>RCE</strong>) attacks.</p>
<p>The <em>ObjectSerializationDecoder</em> in Apache <strong>MINA</strong>
uses <strong>Java</strong> native deserialization protocol to process incoming
serialized data but lacks the necessary security checks and defenses. This
vulnerability allows attackers to exploit the deserialization process by
sending specially crafted malicious serialized data,
potentially leading to remote code execution (<strong>RCE</strong>)
attacks.</p>
<p>A security release has been issued in Decmber 2024, but was incomplete. An
allow-list of classes was added to tell MINA which classes can be used by the
deserialization of messages through the <em>AbstractIoBuffer.getObject()</em>
method, but static classes or primitives types are bypassing this check.</p>
-<h2 id="versions-affected-2">Versions affected</h2>
+<h2 id="affected-versions-2">Affected versions</h2>
<p>These issues affects <strong>MINA</strong> core versions 2.1.X and 2.2.X,
and is fixed by the releases 2.1.12 and 2.2.7.</p>
<h2 id="mitigation-2">Mitigation</h2>
<p>It’s also important to note that an application using
<strong>MINA</strong> core library will only be affected if the
<em>IoBuffer#getObject()</em> method is called, and this specific method is
potentially called when adding a <em>ProtocolCodecFilter</em> instance using
the <em>ObjectSerializationCodecFactory</em> class in the filter chain. If your
application is specifically using those classes, you have to upgrade to the
latest version of <strong>MINA</strong> core library.</p>
@@ -290,7 +290,7 @@ potentially leading to remote code execution
(<strong>RCE</strong>) attacks.</p>
<p>The <em>ObjectSerializationDecoder</em> in Apache <strong>MINA</strong>
uses <strong>Java</strong> native deserialization protocol to process incoming
serialized data but lacks the necessary security checks and defenses. This
vulnerability allows attackers to exploit the deserialization process by
sending specially crafted malicious serialized data,
potentially leading to remote code execution (<strong>RCE</strong>)
attacks.</p>
<p>A security release has been issued in Decmber 2024, but was incomplete. An
allow-list of classes was added to tell MINA which classes can be used by the
deserialization of messages through the <em>AbstractIoBuffer.getObject()</em>
method, but static classes or primitives types are bypassing this check.</p>
-<h2 id="versions-affected-3">Versions affected</h2>
+<h2 id="affected-versions-3">Affected versions</h2>
<p>These issues affects <strong>MINA</strong> core versions 2.0.X, 2.1.X and
2.2.X, and is fixed by the releases 2.0.28, 2.1.11 and 2.2.6.</p>
<h2 id="mitigation-3">Mitigation</h2>
<p>It’s also important to note that an application using
<strong>MINA</strong> core library will only be affected if the
<em>IoBuffer#getObject()</em> method is called, and this specific method is
potentially called when adding a <em>ProtocolCodecFilter</em> instance using
the <em>ObjectSerializationCodecFactory</em> class in the filter chain. If your
application is specifically using those classes, you have to upgrade to the
latest version of <strong>MINA</strong> core library.</p>
diff --git a/content/mina-project/index.xml b/content/mina-project/index.xml
index 94aa98325..8b59de94e 100644
--- a/content/mina-project/index.xml
+++ b/content/mina-project/index.xml
@@ -774,7 +774,7 @@ Apache MINA is often called:
<description>News MINA 2.1.15 and 2.1.31 released posted on June, 27
2026 The MINA project is pleased to announce the MINA 2.1.15 and 2.0.31
releases.
This is a bug fix release: A fix for CVE-2026-47065 (&ldquo;Critical
Deserialization Allow-list Bypass via resolveProxyClass&rdquo;)
hasn&rsquo;t been backported to these two version.
Many thanks to tonghuaroot who have reported this mistake.
-Versions affected These issues affects MINA core versions prior to 2.1.15 and
2.0.31
+Affected versions These issues affects MINA core versions prior to 2.1.15 and
2.0.31
Mitigation Those who used the versions 2.</description>
</item>
diff --git a/content/mina-project/news.html b/content/mina-project/news.html
index 6e4d78a2e..8081aef26 100644
--- a/content/mina-project/news.html
+++ b/content/mina-project/news.html
@@ -127,15 +127,15 @@
<p>The MINA project is pleased to announce the MINA 2.1.15 and 2.0.31
releases.</p>
<p>This is a bug fix release: A fix for CVE-2026-47065 (“Critical
Deserialization Allow-list Bypass via resolveProxyClass”) hasn’t
been backported to these two version.</p>
<p>Many thanks to <strong>tonghuaroot</strong> who have reported this
mistake.</p>
-<h2 id="versions-affected">Versions affected</h2>
+<h2 id="affected-versions">Affected versions</h2>
<p>These issues affects <strong>MINA</strong> core versions prior to 2.1.15
and 2.0.31</p>
<h2 id="mitigation">Mitigation</h2>
<p>Those who used the versions 2.2.14, 2.0.30 and prior have to upgrade.</p>
-<h2 id="mina-228-2114-2030-released-_posted-on-june-19-2026_">MINA 2.2.8,
2.1.14, 2.0.30 released <em>posted on June, 19 2026</em></h2>
-<p>The MINA project is pleased to announce the MINA 2.2.8, 2.1.14 and 2.0.30
releases.</p>
+<h2 id="mina-229-2114-2030-released-_posted-on-june-19-2026_">MINA 2.2.9,
2.1.14, 2.0.30 released <em>posted on June, 19 2026</em></h2>
+<p>The MINA project is pleased to announce the MINA 2.2.9, 2.1.14 and 2.0.30
releases.</p>
<p>This is a bug fix release: the last release was supposed to fix the
Compression Filter, and it does, to some extent, except that a copy/paste made
it so that the deflater became actually an inflater. The unit test for this
feature has been… commented (due to a Mock library migration that
didn’t go well, and it was expected to be temporary), so all the tests
passed green. Wrongly…</p>
<p>Bottom line thanks to Jörg Michelberger who accuratly reviewed the code, we
were made aware of this mistake, and decided to cut this release ASAP.</p>
-<h2 id="versions-affected-1">Versions affected</h2>
+<h2 id="affected-versions-1">Affected versions</h2>
<p>These issues affects <strong>MINA</strong> core versions 2.2.8, 2.1.13 and
2.0.29 and none of the previous versions</p>
<h2 id="mitigation-1">Mitigation</h2>
<p>Those who used the previous version 2.2.8, 2.1.13, 2.0.29 and using the
compression filter have to upgrade.</p>
@@ -217,7 +217,7 @@ potentially leading to remote code execution
(<strong>RCE</strong>) attacks.</p>
<p>The <em>ObjectSerializationDecoder</em> in Apache <strong>MINA</strong>
uses <strong>Java</strong> native deserialization protocol to process incoming
serialized data but lacks the necessary security checks and defenses. This
vulnerability allows attackers to exploit the deserialization process by
sending specially crafted malicious serialized data,
potentially leading to remote code execution (<strong>RCE</strong>)
attacks.</p>
<p>A security release has been issued in Decmber 2024, but was incomplete. An
allow-list of classes was added to tell MINA which classes can be used by the
deserialization of messages through the <em>AbstractIoBuffer.getObject()</em>
method, but static classes or primitives types are bypassing this check.</p>
-<h2 id="versions-affected-2">Versions affected</h2>
+<h2 id="affected-versions-2">Affected versions</h2>
<p>These issues affects <strong>MINA</strong> core versions 2.1.X and 2.2.X,
and is fixed by the releases 2.1.12 and 2.2.7.</p>
<h2 id="mitigation-2">Mitigation</h2>
<p>It’s also important to note that an application using
<strong>MINA</strong> core library will only be affected if the
<em>IoBuffer#getObject()</em> method is called, and this specific method is
potentially called when adding a <em>ProtocolCodecFilter</em> instance using
the <em>ObjectSerializationCodecFactory</em> class in the filter chain. If your
application is specifically using those classes, you have to upgrade to the
latest version of <strong>MINA</strong> core library.</p>
@@ -277,7 +277,7 @@ potentially leading to remote code execution
(<strong>RCE</strong>) attacks.</p>
<p>The <em>ObjectSerializationDecoder</em> in Apache <strong>MINA</strong>
uses <strong>Java</strong> native deserialization protocol to process incoming
serialized data but lacks the necessary security checks and defenses. This
vulnerability allows attackers to exploit the deserialization process by
sending specially crafted malicious serialized data,
potentially leading to remote code execution (<strong>RCE</strong>)
attacks.</p>
<p>A security release has been issued in Decmber 2024, but was incomplete. An
allow-list of classes was added to tell MINA which classes can be used by the
deserialization of messages through the <em>AbstractIoBuffer.getObject()</em>
method, but static classes or primitives types are bypassing this check.</p>
-<h2 id="versions-affected-3">Versions affected</h2>
+<h2 id="affected-versions-3">Affected versions</h2>
<p>These issues affects <strong>MINA</strong> core versions 2.0.X, 2.1.X and
2.2.X, and is fixed by the releases 2.0.28, 2.1.11 and 2.2.6.</p>
<h2 id="mitigation-3">Mitigation</h2>
<p>It’s also important to note that an application using
<strong>MINA</strong> core library will only be affected if the
<em>IoBuffer#getObject()</em> method is called, and this specific method is
potentially called when adding a <em>ProtocolCodecFilter</em> instance using
the <em>ObjectSerializationCodecFactory</em> class in the filter chain. If your
application is specifically using those classes, you have to upgrade to the
latest version of <strong>MINA</strong> core library.</p>
diff --git a/content/mina-project/technical-documentation/ssl-tls-internal.html
b/content/mina-project/technical-documentation/ssl-tls-internal.html
index a3a6815ba..769d27d6c 100644
--- a/content/mina-project/technical-documentation/ssl-tls-internal.html
+++ b/content/mina-project/technical-documentation/ssl-tls-internal.html
@@ -432,13 +432,17 @@ In the second case, we have a different problem: if we
delegate the tasks to sep
<p>Otherwise, it’s pretty straightforward.</p>
<p>The generl algorithm is the following:</p>
<pre><code>- get the received bytes
-- check that the inbound channel is not closed
+- check that the inbound channel is not closed. If it's closed, throw an
exception
- allocate a decoded buffer if needed
- try to unwrap the received data
- if we don't have enough data to decode it into an application message
- - wait for more incomoing data, and restart
+ - exit the loop. We will go through the process once we have received more
bytes
+- else
+ - push the decoded message to the next filter
+ - if we have some more bytes to deal with, restart to step 2, otherwise exit
the loop
-</code></pre><p>Here are the calls</p>
+</code></pre><p>One of the issue here is that we can’t know what will be
the size of the decoded buffer.</p>
+<p>Here are the calls in the current implementation:</p>
<pre><code>SslFilter.messageReceived()
|
+-- SslHandler.receive()
diff --git a/content/sitemap.xml b/content/sitemap.xml
index d51caa3b7..725753a13 100644
--- a/content/sitemap.xml
+++ b/content/sitemap.xml
@@ -959,12 +959,12 @@
<url>
<loc>https://mina.apache.org/mina-project.html</loc>
- <lastmod>2026-06-27T08:22:13+02:00</lastmod>
+ <lastmod>2026-07-31T17:55:46+02:00</lastmod>
</url>
<url>
<loc>https://mina.apache.org/mina-project/news.html</loc>
- <lastmod>2026-06-27T08:22:13+02:00</lastmod>
+ <lastmod>2026-07-31T17:55:46+02:00</lastmod>
</url>
<url>
@@ -1069,7 +1069,7 @@
<url>
<loc>https://mina.apache.org/mina-project/technical-documentation/ssl-tls-internal.html</loc>
- <lastmod>2026-06-27T08:22:13+02:00</lastmod>
+ <lastmod>2026-07-31T17:55:46+02:00</lastmod>
</url>
<url>
