Not rated
CVE-2021-38542 Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command
Description
Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle command injection attacks, leading potentially to leakage of sensible information.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache James 3.6 | earliest → < 3.6.1 | 3.6.1 |
References
- www.openwall.com www.openwall.com
- [oss-security] 20220104 CVE-2021-38542: Apache James vulnerable to STARTTLS command injection (IMAP and POP3) www.openwall.com
- [oss-security] 20220919 CVE-2022-28220: STARTTLS command injection in Apache JAMES www.openwall.com
Timeline
- Published
- Last modified
Other CVEs of Apache James
The 7 CVEs of Apache James →
CVE-2022-28220
Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS…
Not rated
CVE-2022-22931
Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations
Not rated
CVE-2021-40525
Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path…
Not rated
CVE-2021-40111
In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP…
Not rated