GHSA-jw7r-rxff-gv24
Apache James MIME4J improper input validation vulnerability
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2024-21742
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Description
Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages.
Paquets affectés
| Paquet | Versions |
|---|---|
| Maven · org.apache.james:apache-mime4j-core | introduced 0, fixed 0.8.10 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2024-21742 ADVISORY
- https://github.com/apache/james-mime4j/commit/9dec5df2a588fed8027839815daefa79ee66efd1 WEB
- https://github.com/apache/james-mime4j/commit/d25fb3fd35db42b060789a20634fbe3cb84aba17 WEB
- https://github.com/apache/james-mime4j PACKAGE
- https://lists.apache.org/thread/nrqzg93219wdj056pqfszsd33dc54kfy WEB
- http://www.openwall.com/lists/oss-security/2024/02/27/5 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |