CVE-2021-38542 Apache James vulnerable to STARTTLS command injection (IMAP and POP3)
Attackers can inject commands via STARTTLS in IMAP/POP3, potentially leaking sensitive information through man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-38542?
CVE-2021-38542 is a medium-severity command injection vulnerability in Apache James, published on 4 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle command injection attacks, leading potentially to leakage of sensible information.
Which versions are affected by CVE-2021-38542?
2 open source packages ship an affected version, including org.apache.james:james-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.james:james-server Maven | All versions | 3.6.1 |
org.apache.james:james-server Maven | All versions | 3.6.1 |
Products include Apache James.
How do I fix CVE-2021-38542?
Upgrade org.apache.james:james-server to 3.6.1 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-38542 being exploited?
There is no known exploitation of CVE-2021-38542 in the wild and no public exploit code.
Other vulnerabilities in Apache James
- CVE-2023-51518 Apache James server: Privilege escalation via JMX pre-authentication deserialisation
- CVE-2019-0228 Vulnerability that affects org.apache.pdfbox:pdfbox
- CVE-2021-40525 Sieve file storage vulnerable to path traversal attacks
- CVE-2023-26269 Apache James server: Privilege escalation through unauthenticated JMX
- CVE-2006-2806 Denial of service in n/a
Sources
Also known as GHSA-84wg-rgp8-2hg4.