+1 I tested the source zip files for both versions.
- ASC OK - SHA512 OK - Building 'mvn clean verify` OK Using: java version "1.8.0_481" Java(TM) SE Runtime Environment (build 1.8.0_481-b10) Java HotSpot(TM) 64-Bit Server VM (build 25.481-b10, mixed mode) Apache Maven 3.9.16 (2bdd9fddda4b155ebf8000e807eb73fd829a51d5) Maven home: /opt/homebrew/Cellar/maven/3.9.16/libexec Java version: 1.8.0_481, vendor: Oracle Corporation, runtime: /Library/Java/JavaVirtualMachines/jdk-1.8.jdk/Contents/Home/jre Default locale: en_US, platform encoding: UTF-8 OS name: "mac os x", version: "26.5.1", arch: "aarch64", family: "mac" Darwin ****.local 25.5.0 Darwin Kernel Version 25.5.0: Mon Apr 27 20:41:15 PDT 2026; root:xnu-12377.121.6~2/RELEASE_ARM64_T6041 arm64 Docker version 29.4.3, build 055a478 Gary On Mon, Jun 22, 2026 at 6:07 PM Emmanuel Lecharny <[email protected]> wrote: > > Ah, my bad, the links are: > > https://dist.apache.org/repos/dist/dev/mina/mina/mina-2.1.15/ > https://dist.apache.org/repos/dist/dev/mina/mina/mina-2.0.31/ > > On Mon, Jun 22, 2026 at 4:22 PM Gary Gregory <[email protected]> wrote: > > > > https://dist.apache.org/repos/dist/dev/mina/mina/2.0.31/ > > https://dist.apache.org/repos/dist/dev/mina/mina/2.1.15/ > > > > That's 404 > > > > Gary > > > > On Mon, Jun 22, 2026 at 8:22 AM Emmanuel Lecharny <[email protected]> > > wrote: > > > > > > Hi, > > > > > > this double vote is for a release that fixes some missing back-ported > > > code from 2.2.X branch > > > The back-ported code fixes CVE-2026-47065: > > > > > > ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter > > > Bypass via java.lang.reflect.Proxy > > > > > > Assessment: Fully addressed. > > > > > > When the serialised stream contains a TC_PROXYCLASSDESC (the marker > > > for a java.lang.reflect.Proxy ), JDK’s > > > ObjectInputStream.readProxyDesc() is dispatched. JDK then calls the > > > default ObjectInputStream.resolveProxyClass(interfaces) > > > implementation, which performs Class.forName(intf, false, > > > latestUserDefinedLoader()) for EACH interface name and constructs the > > > proxy class — bypassing the accepted classes list . > > > > > > > > > The packages are available at : > > > > > > MINA 2.0.31 > > > =========== > > > > > > https://repository.apache.org/content/repositories/orgapachemina-1148/org/apache/mina/ > > > and > > > https://dist.apache.org/repos/dist/dev/mina/mina/2.0.31/ > > > > > > [ ] +1 Release > > > [ ] ± 0 Abstain > > > [ ] -1 Do Not Release > > > > > > MINA 2.1.15 > > > =========== > > > > > > https://repository.apache.org/content/repositories/orgapachemina-11498/org/apache/mina/ > > > and > > > https://dist.apache.org/repos/dist/dev/mina/mina/2.1.15/ > > > > > > [ ] +1 Release > > > [ ] ± 0 Abstain > > > [ ] -1 Do Not Release > > > > > > > > > Thanks! > > > -- > > > Regards, > > > Cordialement, > > > Emmanuel Lécharny > > > www.worteks.com > > > > > > --------------------------------------------------------------------- > > > To unsubscribe, e-mail: [email protected] > > > For additional commands, e-mail: [email protected] > > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: [email protected] > > For additional commands, e-mail: [email protected] > > > > > -- > Regards, > Cordialement, > Emmanuel Lécharny > www.worteks.com > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
