org.apache.mina:mina-core@2.1.9 vulnerabilities

org.apache.mina:mina-core is a network application framework which helps users develop high performance and high scalability network applications easily.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the ObjectSerializationDecoder due to improper user input sanitization. An attacker can execute arbitrary code by sending specially crafted malicious serialized data.

Note:

1. This is only exploitable if the IoBuffer#getObject method is called and a ProtocolCodecFilter instance using the ObjectSerializationCodecFactory class is added to the filter chain.

2. The FtpServer, SSHd and Vysper sub-project are not affected by this issue.

3. After upgrading to the fixed version, it is required to explicitly allow the classes the decoder will accept in the ObjectSerializationDecoder instance, using one of the three new methods: accept(ClassNameMatcher classNameMatcher), accept(Pattern pattern), or accept(String... patterns).

Upgrade org.apache.mina:mina-core to version 2.0.27, 2.1.10, 2.2.4 or higher.