[
https://issues.apache.org/jira/browse/TOMEE-3838?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17492456#comment-17492456
]
Richard Zowalla commented on TOMEE-3838:
----------------------------------------
In addition, looking at the changelog from apache-mime4j-core I do not see any
CVE-related changes:
https://github.com/apache/james-mime4j/blob/master/CHANGELOG.md since 0.8.1
> TomEE Plume - CVE-2021-40110
> ----------------------------
>
> Key: TOMEE-3838
> URL: https://issues.apache.org/jira/browse/TOMEE-3838
> Project: TomEE
> Issue Type: Bug
> Components: TomEE Core Server
> Affects Versions: 8.0.9
> Reporter: AJIT GOPALAN
> Priority: Blocker
>
> TomEE Plume 8.0.9 suffers from CVE-2021-40110
> This is a bug in Apache James, that manifests itself through the Geronimo
> Mail jar dependency in TomEE ({_}layer.tar: apache-tomee-8.0.9-plume.tar.gz:
> apache-tomee-8.0.9-plume.tar: geronimo-javamail_1.6_mail-1.0.1.jar (shaded:
> org.apache.james:apache-mime4j-core:0.8.1){_})
> CVE Summary -
> _"In Apache James, using Jazzer fuzzer, we identified that an IMAP user can
> craft IMAP LIST commands to orchestrate a Denial Of Service using a
> vulnerable Regular expression. This affected Apache James prior to 3.6.1 We
> recommend upgrading to Apache James 3.6.1 or higher , which enforce the use
> of RE2J regular expression engine to execute regex in linear time without
> back-tracking."_
> [https://nvd.nist.gov/vuln/detail/CVE-2021-40110#vulnCurrentDescriptionTitle]
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
