GHSA-56jp-w6vw-j3jw

Apache James vulnerable to denial of service through the use of IMAP literals

Source: GitHub Advisory Database (reviewed) High CVE-2024-37358

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.james.protocols:protocols-imap	< 3.7.6	3.7.6
Maven	org.apache.james.protocols:protocols-imap	>= 3.8.0, < 3.8.2	3.8.2

Details

As written in the advisory (Markdown source, shown as plain text).

Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated users, which could be used to cause unbounded memory allocation and very long computations Version 3.7.6 and 3.8.2 restrict such illegitimate use of IMAP literals.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-37358 advisory
https://github.com/apache/james-project/commit/6dd3ad9ea1f6a9bc887d2c7af3f5aa30a60ec769 web
https://github.com/apache/james-project/commit/b2f3c06edfd37b409121bf04c56a6f026048a77e web
https://github.com/apache/james-project package
https://lists.apache.org/thread/1pxsh11v5s3fkvhnqvkmlqwt3fgpcrqc web