CVE-2022-28220

STARTTLS command injection in Apache JAMES

State: Published
Severity: Not scored
Published: Sep 8, 2022
Updated: Aug 3, 2024
Reserved: Mar 30, 2022

Description

Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solved similar problem fron Apache James 3.6.1, is subject to a parser differential and do not take into account concurrent requests.

Scores

The record has no CVSS score.

Weaknesses

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Affected Products

Product	Versions
Apache JamesApache Software Foundation	Apache James through 3.6.2Affected

References

https://james.apache.org/james/update/2022/08/26/james-3.7.1.html
[oss-security] 20220919 CVE-2022-28220: STARTTLS command injection in Apache JAMESmailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.