Non notée
CVE-2022-28220 Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS…
Description
Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solved similar problem fron Apache James 3.6.1, is subject to a parser differential and do not take into account concurrent requests.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache James 3.6 | premières → 3.6.2 | Pas de correctif indiqué |
Références
- james.apache.org james.apache.org
- [oss-security] 20220919 CVE-2022-28220: STARTTLS command injection in Apache JAMES www.openwall.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache James
Les 7 CVE de Apache James →
CVE-2022-22931
Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations
Non notée
CVE-2021-40525
Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path…
Non notée
CVE-2021-40111
In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP…
Non notée
CVE-2021-40110
In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a…
Non notée