CVE-2021-40110

Denial of Service in Apache James

Résumé

Description d'origine

La description telle que publiée par la source (souvent en anglais).

In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a Denial Of Service using a vulnerable Regular expression. This affected Apache James prior to 3.6.1 We recommend upgrading to Apache James 3.6.1 or higher , which enforce the use of RE2J regular expression engine to execute regex in linear time without back-tracking.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Paquets affectés

Maven org.apache.james:james-server

[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.6.1"}]}]

Références

advisory nvd.nist.gov
web openwall.com
web openwall.com