Skip to content

SMTP smuggling in Apache James

Moderate severity GitHub Reviewed Published Feb 27, 2024 to the GitHub Advisory Database • Updated Mar 4, 2024

Package

maven org.apache.james:james-server (Maven)

Affected versions

< 3.7.5
= 3.8.0

Patched versions

3.7.5
3.8.1

Description

Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling.

A lenient behaviour in line delimiter handling might create a difference of interpretation between the sender and the receiver which can be exploited by an attacker to forge an SMTP envelop, allowing for instance to bypass SPF checks.

The patch implies enforcement of CRLF as a line delimiter as part of the DATA transaction.

We recommend James users to upgrade to non vulnerable versions.

References

Published by the National Vulnerability Database Feb 27, 2024
Published to the GitHub Advisory Database Feb 27, 2024
Reviewed Feb 27, 2024
Last updated Mar 4, 2024

Severity

Moderate

EPSS score

0.045%
(17th percentile)

Weaknesses

CVE ID

CVE-2023-51747

GHSA ID

GHSA-p5q9-86w4-2xr5

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.