PT-2022-18884 · Apache · Apache James

Benoit Tellier · Published 2022-09-08 · Updated 2022-09-30 · CVE-2022-28220

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache James versions prior to 3.6.3 Apache James versions prior to 3.7.1

Description The issue is related to a buffering attack that relies on the use of the STARTTLS command. It is similar to a previously solved problem in Apache James 3.6.1, but the fix for that issue does not account for concurrent requests and is subject to a parser differential.

Recommendations For Apache James versions prior to 3.6.3, update to version 3.6.3 or later. For Apache James versions prior to 3.7.1, update to version 3.7.1 or later.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2022-28220

GHSA-W45J-F5G5-W94X

Affected Products

Apache James

References · 8

• https://james.apache.org/james/update/2022/08/26/james-3.7.1.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28220 · Security Note
• https://osv.dev/vulnerability/GHSA-w45j-f5g5-w94x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-28220 · Vendor Advisory
• https://github.com/apache/james-project · Note
• https://t.me/cibsecurity/49441 · Telegram Post
• https://t.me/cvenotify/35853 · Telegram Post
• http://openwall.com/lists/oss-security/2022/09/20/1 · Note