| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.james:james-server | ≥ 3.7.0, < 3.7.1< 3.6.3 | 3.7.13.6.3 |
| james | = 3.7.0≤ 3.6.2 |
Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solved similar problem fron Apache James 3.6.1, is subject to a parser differential and do not take into account concurrent requests.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free