mina2 (2.2.1-4ubuntu1) stonking; urgency=medium

  * SECURITY UPDATE: Deserialization of Untrusted Data
    - debian/patches/CVE-2026-42779.patch: apply acceptMatchers check in
      resolveClass() and readClassDescriptor() before class loading
    - debian/patches/CVE-2026-47065.patch: override resolveProxyClass() to
      block proxy deserialization bypass and use initialize=false
    - debian/patches/CVE-2026-42778.patch: replace Class.forName() call with
      super.readClassDescriptor() to prevent static initializer execution
    - CVE-2026-42778
    - CVE-2026-42779
    - CVE-2026-47065

 -- Paulo Flabiano Smorigo <pfsmorigo@canonical.com>  Tue, 23 Jun 2026 12:46:27 +0000

mina2 (2.2.1-4) unstable; urgency=medium

  * Team upload
  * Fixing CVE-2024-52046: The ObjectSerializationDecoder in Apache MINA uses
    Java’s native deserialization protocol to process incoming serialized
    data but lacks the necessary security checks and defenses. This
    vulnerability allows attackers to exploit the deserialization process by
    sending specially crafted malicious serialized data, potentially leading to
    remote code execution (RCE) attacks.
    Closes: #1091530

 -- Pierre Gruet <pgt@debian.org>  Tue, 15 Jul 2025 23:47:20 +0200

mina2 (2.2.1-3) unstable; urgency=medium

  * No longer build mina-transport-apr and drop the libtomcat9-java dependency

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 13 Feb 2023 14:48:31 +0100

mina2 (2.2.1-2) unstable; urgency=medium

  * Added the missing dependency on liblog4j1.2-java (Closes: #1028771)
  * Standards-Version updated to 4.6.2

 -- Emmanuel Bourg <ebourg@apache.org>  Sun, 15 Jan 2023 22:42:46 +0100

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libmina2-java`.
