Multiple vulnerabilities in Apache James



Risk Medium
Patch available YES
Number of vulnerabilities 4
CVE-ID CVE-2021-40111
CVE-2021-38542
CVE-2021-40525
CVE-2021-40110
CWE-ID CWE-835
CWE-77
CWE-22
CWE-185
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Apache James
Server applications / Mail servers

Vendor Apache Foundation

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Infinite loop

EUVDB-ID: #VU59162

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-40111

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop when parsing APPEND and STATUS IMAP commands. A remote user can send  a specially crafted command to the server, consume all available system resources and cause denial of service conditions.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apache James: 2.1 - 3.6.0

CPE2.3 External links

https://seclists.org/oss-sec/2022/q1/3


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Command Injection

EUVDB-ID: #VU59161

Risk: Medium

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-38542

CWE-ID: CWE-77 - Command injection

Exploit availability: No

Description

The vulnerability allows a remote attacker to inject arbitrary commands.

The vulnerability exists due to incorrect implementation of the STARTTLS command in the IMAP and POP3 servers. A remote attacker with ability to perform MitM attack can inject arbitrary IMAP or POP3 commands before successful initialization of the TLS session and execute these commands after the session was initialized.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apache James: 2.1 - 3.6.0

CPE2.3
External links

https://seclists.org/oss-sec/2022/q1/1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Path traversal

EUVDB-ID: #VU59160

Risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-40525

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences within the Sieve file storage implementation. A remote user can send a specially crafted request and read or write arbitrary files on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Apache James: 2.1 - 3.6.0

CPE2.3
External links

https://seclists.org/oss-sec/2022/q1/4


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Incorrect Regular Expression

EUVDB-ID: #VU59154

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-40110

CWE-ID: CWE-185 - Incorrect Regular Expression

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to improper input validation when parsing IMAP LIST commands. A remote user can send a specially crafted IMAP command to the server and perform a regular expression denial of service (ReDoS).

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apache James: 2.1 - 3.6.0

CPE2.3
External links

https://seclists.org/oss-sec/2022/q1/2


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###