CVE-2019-0231

El manejo del mensaje close_notify de SSL/TLS no conlleva a un cierre de la conexión, conduciendo a que el servidor retenga el socket abierto y que el cliente reciba potencialmente mensajes de texto sin cifrar más tarde. Mitigación: los usuarios de la versión 2.0.20 deberían migrar a la versión 2.0.21, los usuarios de la versión 2.1.0 deberían migrar a la versión 2.1.1. Este problema afecta a: Apache MINA.

A cryptographic protocol integrity flaw was discovered in Apache Mina. The closure of a TLS session would not always result in closure of the socket, allowing the conversation to continue in clear text. This could undermine the confidentiality of a connection and potentially disclose sensitive information to third-party attackers.

Red Hat Decision Manager is an open source decision management platform that combines business rules management, complex event processing, Decision Model & Notation execution, and Business Optimizer for solving planning problems. It automates business decisions and makes that logic available to the entire business. This release of Red Hat Decision Manager 7.7.0 serves as an update to Red Hat Decision Manager 7.6.0, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include code execution and information leakage vulnerabilities.