CVE-2022-28220 - Vulnerability Details - OpenCVE

Description

Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solved similar problem fron Apache James 3.6.1, is subject to a parser differential and do not take into account concurrent requests.

Published: 2022-09-08

Score: 7.5 High

EPSS: 1.9% Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache James

affected

Version	Status	Constraints
`Apache James`	affected	≤ 3.6.2

Configuration 1 [-]

OR	cpe:2.3:a:apache:james::::::::
	cpe:2.3:a:apache:james:3.7.0:::::::*

No data.

No data available yet.

Remediation

Vendor Workaround

Upgrade to Apache James 3.7.1 or Apache James 3.6.3.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2022-6956	Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solved similar problem fron Apache James 3.6.1, is subject to a parser differential and do not take into account concurrent requests.
Github GHSA	GHSA-w45j-f5g5-w94x	Apache James vulnerable to buffering attack

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.01851.

Key SSVC decision points have not yet been added.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2022/09/20/1
https://james.apache.org/james/update/2022/08/26/james-3.7.1.html

History

No history.

Subscriptions

Apache James

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2022-09-08T07:40:09.000Z

Updated: 2024-08-03T05:48:37.476Z

Reserved: 2022-03-30T00:00:00.000Z

Link: CVE-2022-28220

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-09-08T08:15:07.813

Modified: 2024-11-21T06:56:58.570

Link: CVE-2022-28220

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-77

{"containers": {"cna": {"affected": [{"product": "Apache James", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "3.6.2", "status": "affected", "version": "Apache James", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Apache James PMC would like to thanks Benoit TELLIER for this report, and Fabian Ising for his support."}], "descriptions": [{"lang": "en", "value": "Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solved similar problem fron Apache James 3.6.1, is subject to a parser differential and do not take into account concurrent requests."}], "metrics": [{"other": {"content": {"other": "This can result in Man-in -the-middle command injection attacks, leading potentially to leakage of sensible information like user credentials. Exploit in IMAP requires a local account but SMTP exploit does not. Data integrity could be compromised in POP3."}, "type": "unknown"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-77", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-09-20T11:06:21.000Z", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://james.apache.org/james/update/2022/08/26/james-3.7.1.html"}, {"name": "[oss-security] 20220919 CVE-2022-28220: STARTTLS command injection in Apache JAMES", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2022/09/20/1"}], "source": {"defect": ["JAMES-1862"], "discovery": "UNKNOWN"}, "title": "STARTTLS command injection in Apache JAMES", "workarounds": [{"lang": "en", "value": "Upgrade to Apache James 3.7.1 or Apache James 3.6.3."}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@apache.org", "ID": "CVE-2022-28220", "STATE": "PUBLIC", "TITLE": "STARTTLS command injection in Apache JAMES"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Apache James", "version": {"version_data": [{"version_affected": "<=", "version_name": "Apache James", "version_value": "3.6.2"}, {"version_affected": "<=", "version_name": "Apache James", "version_value": "3.7.0 +1"}]}}]}, "vendor_name": "Apache Software Foundation"}]}}, "credit": [{"lang": "eng", "value": "Apache James PMC would like to thanks Benoit TELLIER for this report, and Fabian Ising for his support."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solved similar problem fron Apache James 3.6.1, is subject to a parser differential and do not take into account concurrent requests."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": [{"other": "This can result in Man-in -the-middle command injection attacks, leading potentially to leakage of sensible information like user credentials. Exploit in IMAP requires a local account but SMTP exploit does not. Data integrity could be compromised in POP3."}], "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}]}, "references": {"reference_data": [{"name": "https://james.apache.org/james/update/2022/08/26/james-3.7.1.html", "refsource": "MISC", "url": "https://james.apache.org/james/update/2022/08/26/james-3.7.1.html"}, {"name": "[oss-security] 20220919 CVE-2022-28220: STARTTLS command injection in Apache JAMES", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2022/09/20/1"}]}, "source": {"defect": ["JAMES-1862"], "discovery": "UNKNOWN"}, "work_around": [{"lang": "en", "value": "Upgrade to Apache James 3.7.1 or Apache James 3.6.3."}]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T05:48:37.476Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://james.apache.org/james/update/2022/08/26/james-3.7.1.html"}, {"name": "[oss-security] 20220919 CVE-2022-28220: STARTTLS command injection in Apache JAMES", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2022/09/20/1"}]}]}, "cveMetadata": {"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2022-28220", "datePublished": "2022-09-08T07:40:09.000Z", "dateReserved": "2022-03-30T00:00:00.000Z", "dateUpdated": "2024-08-03T05:48:37.476Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:james:*:*:*:*:*:*:*:*", "matchCriteriaId": "423D85DB-E258-4B34-B941-99C4458273E6", "versionEndIncluding": "3.6.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:james:3.7.0:*:*:*:*:*:*:*", "matchCriteriaId": "7D32CBE3-3A1D-4D8F-8C91-E127FAB55BFF", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solved similar problem fron Apache James 3.6.1, is subject to a parser differential and do not take into account concurrent requests."}, {"lang": "es", "value": "Apache James versiones anteriores a 3.6.3 y 3.7.1, es vulnerable a un ataque de almacenamiento en b\u00fafer que depende del uso del comando STARTTLS. La correcci\u00f3n de CVE-2021-38542, que resolvi\u00f3 un problema similar de Apache James versi\u00f3n 3.6.1, est\u00e1 sujeta a un diferencial de analizador y no toma en cuenta las peticiones simult\u00e1neas"}], "id": "CVE-2022-28220", "lastModified": "2024-11-21T06:56:58.570", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-09-08T08:15:07.813", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/09/20/1"}, {"source": "security@apache.org", "tags": ["Patch", "Release Notes", "Vendor Advisory"], "url": "https://james.apache.org/james/update/2022/08/26/james-3.7.1.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/09/20/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Release Notes", "Vendor Advisory"], "url": "https://james.apache.org/james/update/2022/08/26/james-3.7.1.html"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "security@apache.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-77"}], "source": "nvd@nist.gov", "type": "Primary"}]}