Lucene search

[email protected]CVE-2021-40111

HistoryJan 04, 2022 - 9:15 a.m.

CVE-2021-40111

2022-01-0409:15:07

CWE-835

[email protected]

web.nvd.nist.gov

apache james

vulnerability

dos attack

imap

authentication

cve-2021-40111

patch

nvd

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

35.0%

JSON

In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP command could be used to trigger infinite loops resulting in expensive CPU computations and OutOfMemory exceptions. This can be used for a Denial Of Service attack. The IMAP user needs to be authenticated to exploit this vulnerability. This affected Apache James prior to version 3.6.1. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade.

Affected configurations

Vulners

NVD

Node

apachejamesRange≤3.6.0

CPENameOperatorVersion
apache:jamesapache jameslt3.6.1

CPE	Name	Operator	Version
apache:james	apache james	lt	3.6.1

CNA Affected

[
  {
    "product": "Apache James",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "3.6.0",
        "status": "affected",
        "version": "Apache James",
        "versionType": "custom"
      }
    ]
  }
]