MEDIUM5.3

GHSA-jw7r-rxff-gv24

Apache James MIME4J improper input validation vulnerability

Quick fix

GHSA-jw7r-rxff-gv24 — org.apache.james:apache-mime4j-core: upgrade to the fixed version with the command below.

# pom.xml: bump <version>0.8.10</version> for org.apache.james:apache-mime4j-core

Details

Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.apache.james:apache-mime4j-core

Introduced in: 0Fixed in: 0.8.10

Fix# pom.xml: bump <version>0.8.10</version> for org.apache.james:apache-mime4j-core

References

https://nvd.nist.gov/vuln/detail/CVE-2024-21742[ADVISORY]
https://github.com/apache/james-mime4j/commit/9dec5df2a588fed8027839815daefa79ee66efd1[WEB]
https://github.com/apache/james-mime4j/commit/d25fb3fd35db42b060789a20634fbe3cb84aba17[WEB]
https://github.com/apache/james-mime4j[PACKAGE]
https://lists.apache.org/thread/nrqzg93219wdj056pqfszsd33dc54kfy[WEB]
http://www.openwall.com/lists/oss-security/2024/02/27/5[WEB]