CVE-2021-38542
published 2022-01-04CVE-2021-38542: Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle…
PriorityP433medium5.9CVSS 3.1
AVNACHPRNUINSUCHINAN
EPSS
2.35%
81.7th percentile
Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle command injection attacks, leading potentially to leakage of sensible information.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | james | < 3.6.1 | 3.6.1 |
| apache | james | <= 3.6.2 | — |
| apache | james | — | — |
| apache_software_foundation | apache_james | Apache James – 3.6.2 | — |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
ghsa5.9MEDIUM
osv5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache James vulnerable to buffering attack
ghsa·2022-09-09·CVSS 5.9
CVE-2022-28220 [MEDIUM] CWE-77 Apache James vulnerable to buffering attack
Apache James vulnerable to buffering attack
Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solved similar problem fron Apache James 3.6.1, is subject to a parser differential and do not take into account concurrent requests.
OSV
Apache James vulnerable to buffering attack
osv·2022-09-09·CVSS 5.9
CVE-2022-28220 [MEDIUM] Apache James vulnerable to buffering attack
Apache James vulnerable to buffering attack
Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solved similar problem fron Apache James 3.6.1, is subject to a parser differential and do not take into account concurrent requests.
OSV
Command Injection in Apache James
osv·2022-01-08
CVE-2021-38542 [MEDIUM] Command Injection in Apache James
Command Injection in Apache James
Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle command injection attacks, leading potentially to leakage of sensible information.
GHSA
Command Injection in Apache James
ghsa·2022-01-08
CVE-2021-38542 [MEDIUM] CWE-327 Command Injection in Apache James
Command Injection in Apache James
Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle command injection attacks, leading potentially to leakage of sensible information.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2022/01/04/1http://www.openwall.com/lists/oss-security/2022/09/20/1https://www.openwall.com/lists/oss-security/2022/01/04/1http://www.openwall.com/lists/oss-security/2022/01/04/1http://www.openwall.com/lists/oss-security/2022/09/20/1https://www.openwall.com/lists/oss-security/2022/01/04/1
2022-01-04
Published