github - ghsa-jw7r-rxff-gv24

ghsa-jw7r-rxff-gv24

Vulnerability from github

Published

2024-02-27 18:31

Modified

2024-03-01 14:41

Summary

Apache James MIME4J improper input validation vulnerability

Details

Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.james:apache-mime4j-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.8.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-21742"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-27T21:54:39Z",
    "nvd_published_at": "2024-02-27T17:15:12Z",
    "severity": "MODERATE"
  },
  "details": "Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message.\nThis can be exploited by an attacker to add unintended headers to MIME messages.\n",
  "id": "GHSA-jw7r-rxff-gv24",
  "modified": "2024-03-01T14:41:42Z",
  "published": "2024-02-27T18:31:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21742"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/james-mime4j/commit/9dec5df2a588fed8027839815daefa79ee66efd1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/james-mime4j/commit/d25fb3fd35db42b060789a20634fbe3cb84aba17"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/james-mime4j"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/nrqzg93219wdj056pqfszsd33dc54kfy"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2024/02/27/5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Apache James MIME4J improper input validation vulnerability"
}

cve-2024-21742

Vulnerability from cvelistv5

Published

2024-02-27 16:21

Modified

2024-08-01 22:27

Severity ?

Summary

Apache James Mime4J: Mime4J DOM header injection

References

▼	URL	Tags
	https://lists.apache.org/thread/nrqzg93219wdj056pqfszsd33dc54kfy	vendor-advisory
	http://www.openwall.com/lists/oss-security/2024/02/27/5

Impacted products

▼	Vendor	Product
	Apache Software Foundation	Apache James Mime4J

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21742",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-05T20:19:13.590898Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:37:41.315Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:27:36.169Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/nrqzg93219wdj056pqfszsd33dc54kfy"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/02/27/5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.james:apache-mime4j-dom",
          "product": "Apache James Mime4J",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "0.8.9",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Benoit TELLIER"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message.\u003cbr\u003eThis can be exploited by an attacker to add unintended headers to MIME messages.\u003cbr\u003e"
            }
          ],
          "value": "Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message.\nThis can be exploited by an attacker to add unintended headers to MIME messages.\n"
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-27T16:21:16.432Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/nrqzg93219wdj056pqfszsd33dc54kfy"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/02/27/5"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Apache James Mime4J: Mime4J DOM header injection",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2024-21742",
    "datePublished": "2024-02-27T16:21:16.432Z",
    "dateReserved": "2024-01-02T06:51:12.024Z",
    "dateUpdated": "2024-08-01T22:27:36.169Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted