CVE-2021-40110

Denial of Service in Apache James

概要

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a Denial Of Service using a vulnerable Regular expression. This affected Apache James prior to 3.6.1 We recommend upgrading to Apache James 3.6.1 or higher , which enforce the use of RE2J regular expression engine to execute regex in linear time without back-tracking.

出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

影響パッケージ

Maven org.apache.james:james-server

[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.6.1"}]}]

参照URL

advisory nvd.nist.gov
web openwall.com
web openwall.com