CVEvulnerability
CVE-2023-51747
7.1 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2024-02-27
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 7.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
- Weaknesses
- CWE-20, CWE-290, CWE-444
Description
Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling.
A lenient behaviour in line delimiter handling might create a difference of interpretation between the sender and the receiver which can be exploited by an attacker to forge an SMTP envelop, allowing for instance to bypass SPF checks.
The patch implies enforcement of CRLF as a line delimiter as part of the DATA transaction.
We recommend James users to upgrade to non vulnerable versions.
Affected configurations
• apache james 3.7.5
• apache james 3.8.1
Related
References
- http://www.openwall.com/lists/oss-security/2024/02/27/4 Mailing List, Third Party Advisory
- https://lists.apache.org/thread/rxkwbkh9vgbl9rzx1fkllyk3krhgydko Mailing List, Vendor Advisory
- https://postfix.org/smtp-smuggling.html Product
- https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/ Product
- http://www.openwall.com/lists/oss-security/2024/02/27/4 Mailing List, Third Party Advisory
- https://lists.apache.org/thread/rxkwbkh9vgbl9rzx1fkllyk3krhgydko Mailing List, Vendor Advisory
- https://postfix.org/smtp-smuggling.html Product
- https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/ Product