GitHub Advisoryadvisory · Maven

GHSA-w45j-f5g5-w94x Apache James vulnerable to buffering attack

HIGH Published 2022-09-09 Modified 2022-09-15 Official page ↗
Aliases
CVE-2022-28220
Ecosystem
Maven
Packages
org.apache.james:james-server
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-77
Reviewed
2022-09-15

Affected packages

• Maven org.apache.james:james-server: < 3.6.3 → fixed in 3.6.3 • Maven org.apache.james:james-server: >= 3.7.0, < 3.7.1 → fixed in 3.7.1

Description

Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solved similar problem fron Apache James 3.6.1, is subject to a parser differential and do not take into account concurrent requests.

Related

Alias · CVE (1)

  • CVE-2022-28220 Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References