Request for Update on Vulnerability Fix and Upgrade Timeline for "org.apache.mina:mina-core@2.0.4"

[Divya-hub-dot]

Hi Team,

We have identified a vulnerability in our organization originating from the library org.apache.mina:mina-core@2.0.4. This library is a dependency of org.apache.ftpserver:ftpserver-core@1.0.6.

To address the issue, we attempted to update the FTP server version to 1.2.0. However, the vulnerability persists even with this version. According to the details, the fix requires upgrading mina-core to one of the following versions:

org.apache.mina:mina-core@2.0.27
org.apache.mina:mina-core@2.1.10
org.apache.mina:mina-core@2.2.4
Could you please let us know when the next upgrade is expected to address this issue? Any updates or guidance regarding this matter would be greatly appreciated.

Looking forward to your response.

[elecharny]

Hi,
a Apache MINA FTPSERVER 1.2.1 is on the work, and I expect it to be released in the coming days or weeks. It will use Apache MINA 2.2.4.

We won't release a Apache MINA FtpServer 1.1.5, this version is most certainly be deprecated.

Also note that Apache MINA FtpServer 1.0.X branch is dead and not maintained.

Last, not least, if you are worried by the MINA CVE that was announced last week, just know that Apache MINA FtpServer is not impacted.