CVE-2021-38542

Apache James vulnerable to STARTTLS command injection (IMAP and POP3)

State: Published
Severity: Not scored
Published: Jan 4, 2022
Updated: Aug 4, 2024
Reserved: Aug 11, 2021

Description

Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle command injection attacks, leading potentially to leakage of sensible information.

Scores

The record has no CVSS score.

Weaknesses

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Affected Products

Product	Versions
Apache JamesApache Software Foundation	Apache James to before 3.6.1Affected

References

https://www.openwall.com/lists/oss-security/2022/01/04/1
[oss-security] 20220104 CVE-2021-38542: Apache James vulnerable to STARTTLS command injection (IMAP and POP3)mailing-list
[oss-security] 20220919 CVE-2022-28220: STARTTLS command injection in Apache JAMESmailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.