Arbitrary Command Injection Affecting org.apache.james:apache-james-mpt-smtp-core Open this link in a new tab package, versions [0,3.6.2)
Attack Complexity
Low
Confidentiality
High
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-JAVA-ORGAPACHEJAMES-2329151
-
published
4 Jan 2022
-
disclosed
4 Jan 2022
-
credit
Benoit Tellier, Raphael Ouazana
Introduced: 4 Jan 2022
CVE-2021-38542 Open this link in a new tabHow to fix?
Upgrade org.apache.james:apache-james-mpt-smtp-core
to version 3.6.2 or higher.
Overview
Affected versions of this package are vulnerable to Arbitrary Command Injection via the STARTTLS
command. This can lead to a leak of sensible information.
Note: another remediation option is to deactivate STARTTLS
and rely solely on explicit TLS
for mail protocols, including SMTP
, IMAP
and POP3
.