CVE-2023-51747

Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling. A lenient behaviour in line delimiter handling might create a difference of interpretation between the sender and the receiver which can be exploited by an attacker to forge an SMTP envelop, allowing for instance to bypass SPF checks. The patch implies enforcement of CRLF as a line delimiter as part of the DATA transaction. We recommend James users to upgrade to non vulnerable versions.
Configurations

No configuration.

History

13 Nov 2024, 19:35

Type Values Removed Values Added
CWE CWE-444
CWE-290
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 7.1
Summary
  • (es) Apache James anterior a las versiones 3.8.1 y 3.7.5 es vulnerable al contrabando SMTP. Un comportamiento indulgente en el manejo del delimitador de línea podría crear una diferencia de interpretación entre el remitente y el receptor que un atacante puede aprovechar para falsificar un sobre SMTP, permitiendo, por ejemplo, eludir las comprobaciones SPF. El parche implica la aplicación de CRLF como delimitador de línea como parte de la transacción de DATOS. Recomendamos a los usuarios de James que actualicen a versiones no vulnerables.

27 Feb 2024, 15:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/02/27/4 -

27 Feb 2024, 14:19

Type Values Removed Values Added
New CVE

Information

Published : 2024-02-27 14:15

Updated : 2024-11-13 19:35


NVD link : CVE-2023-51747

Mitre link : CVE-2023-51747

CVE.ORG link : CVE-2023-51747


JSON object : View

Products Affected

No product.

CWE
CWE-20

Improper Input Validation

CWE-290

Authentication Bypass by Spoofing

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')