GHSA-jw7r-rxff-gv24

Apache James MIME4J improper input validation vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-21742

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.james:apache-mime4j-core	< 0.8.10	0.8.10

Details

As written in the advisory (Markdown source, shown as plain text).

Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-21742 advisory
https://github.com/apache/james-mime4j/commit/9dec5df2a588fed8027839815daefa79ee66efd1 web
https://github.com/apache/james-mime4j/commit/d25fb3fd35db42b060789a20634fbe3cb84aba17 web
https://github.com/apache/james-mime4j package
https://lists.apache.org/thread/nrqzg93219wdj056pqfszsd33dc54kfy web
http://www.openwall.com/lists/oss-security/2024/02/27/5 web