CVE-2022-28220
STARTTLS command injection in Apache JAMES
Résumé
STARTTLS command injection in Apache JAMES
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solved similar problem fron Apache James 3.6.1, is subject to a parser differential and do not take into account concurrent requests.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Maven
org.apache.james:james-server
[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.0"},{"fixed":"3.7.1"}]}]
Références
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web james.apache.org
- web openwall.com