Apache James vulnerable to buffering attack
High severity
GitHub Reviewed
Published
Sep 9, 2022
to the GitHub Advisory Database
•
Updated Jan 30, 2023
Package
Affected versions
< 3.6.3
= 3.7.0
Patched versions
3.6.3
3.7.1
Description
Published by the National Vulnerability Database
Sep 8, 2022
Published to the GitHub Advisory Database
Sep 9, 2022
Reviewed
Sep 15, 2022
Last updated
Jan 30, 2023
Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solved similar problem fron Apache James 3.6.1, is subject to a parser differential and do not take into account concurrent requests.
References