PT-2022-11188 · Apache · Apache James

Benoit Tellier · Published 2022-01-04 · Updated 2022-01-12 · CVE-2021-40111

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache James versions prior to 3.6.1

Description The issue allows for a Denial Of Service attack through crafted APPEND and STATUS IMAP commands, which can trigger infinite loops and result in expensive CPU computations and OutOfMemory exceptions. The IMAP user must be authenticated to exploit this issue.

Recommendations For versions prior to 3.6.1, upgrade to Apache James 3.6.1 or higher to resolve the issue.

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2021-40111

GHSA-FQGW-6QJ5-8HMP

Affected Products

Apache James

References · 5

• https://osv.dev/vulnerability/CVE-2021-40111 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fqgw-6qj5-8hmp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40111 · Security Note
• http://openwall.com/lists/oss-security/2022/01/04/3 · Note
• https://openwall.com/lists/oss-security/2022/01/04/3 · Note