CVE-2021-38542
Command Injection in Apache James
Summary
Command Injection in Apache James
Original description
The description as published by the source.
Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle command injection attacks, leading potentially to leakage of sensible information.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Maven
org.apache.james:james-server
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1"}]}]
References
- advisory nvd.nist.gov
- web openwall.com
- web openwall.com
- web openwall.com