CVE-2022-28220

Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solved similar problem fron Apache James 3.6.1, is subject to a parser differential and do not take into account concurrent requests.

Published: Sep 8, 2022
Updated: May 9, 2024
CVE: CVE-2022-28220
GHSA: GHSA-w45j-f5g5-w94x
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWEs:

CWE-77

OWASP TOP 10:

A1 - Injection

Affected Software
References

Software	From	Fixed in
apache / james	3.7.0	3.7.0.x
apache / james	-	3.6.2.x
org.apache.james / james-server	-	3.6.3
org.apache.james / james-server	3.7.0	3.7.0.x
org.apache.james / james-server	3.7.0	3.7.1

http://www.openwall.com/lists/oss-security/2022/09/20/1
https://james.apache.org/james/update/2022/08/26/james-3.7.1.html

Vulnerability Database

289,697

CVE-2022-28220