CVE-2024-21742: Apache James Mime4J: Mime4J DOM header injection
First published: Tue Feb 27 2024(Updated: )
Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add unintended headers to MIME messages.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.apache.james:apache-mime4j-core | <0.8.10 | 0.8.10 |
| Apache James | <=0.8.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.apache.org/thread/nrqzg93219wdj056pqfszsd33dc54kfy
- https://nvd.nist.gov/vuln/detail/CVE-2024-21742
- https://github.com/apache/james-mime4j/commit/9dec5df2a588fed8027839815daefa79ee66efd1
- https://github.com/apache/james-mime4j/commit/d25fb3fd35db42b060789a20634fbe3cb84aba17
- https://github.com/advisories/GHSA-jw7r-rxff-gv24 (Advisory)
- http://www.openwall.com/lists/oss-security/2024/02/27/5
Frequently Asked Questions
What is the severity of CVE-2024-21742?
CVE-2024-21742 has been classified as a moderate severity vulnerability due to the potential for header injection.
How do I fix CVE-2024-21742?
To fix CVE-2024-21742, upgrade the Apache Mime4j library to version 0.8.10 or later.
What is the impact of CVE-2024-21742?
The impact of CVE-2024-21742 includes the ability for attackers to manipulate MIME message headers, which could lead to unauthorized access or data leakage.
Which versions are affected by CVE-2024-21742?
CVE-2024-21742 affects Apache Mime4j versions prior to 0.8.10 and Apache James Mime4j versions up to 0.8.9.
Who is vulnerable to CVE-2024-21742?
Any application using vulnerable versions of the Apache Mime4j library for message composition is at risk from CVE-2024-21742.
- agent/title
- agent/type
- collector/oss-sec
- source/oss-sec
- alias/CVE-2024-21742
- agent/first-publish-date
- agent/author
- agent/references
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- source/GitHub
- alias/GHSA-jw7r-rxff-gv24
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/trending
- agent/source
- agent/description
- agent/weakness
- agent/event
- agent/tags
- collector/github-advisory-latest
- agent/last-modified-date
- agent/severity
- collector/nvd-api
- agent/software-canonical-lookup-request
- agent/softwarecombine
- package-manager/maven
- vendor/apache
- canonical/apache james
- version/apache james/0.8.9