[
https://issues.apache.org/jira/browse/TOMEE-3838?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Richard Zowalla resolved TOMEE-3838.
------------------------------------
Assignee: Richard Zowalla
Resolution: Invalid
After discussing this with [~jlmonteiro], we both came to the conclusion, that
TomEE is *not* impacted by CVE-2021-40110 as this is a Apache James Server
specific vulnerability, which doesn't relate to apache-mime4j-core shaded in
Geronimo Mail 1.0.1, which is used in TomEE.
> TomEE Plume - CVE-2021-40110
> ----------------------------
>
> Key: TOMEE-3838
> URL: https://issues.apache.org/jira/browse/TOMEE-3838
> Project: TomEE
> Issue Type: Bug
> Components: TomEE Core Server
> Affects Versions: 8.0.9
> Reporter: AJIT GOPALAN
> Assignee: Richard Zowalla
> Priority: Blocker
>
> TomEE Plume 8.0.9 suffers from CVE-2021-40110
> This is a bug in Apache James, that manifests itself through the Geronimo
> Mail jar dependency in TomEE ({_}layer.tar: apache-tomee-8.0.9-plume.tar.gz:
> apache-tomee-8.0.9-plume.tar: geronimo-javamail_1.6_mail-1.0.1.jar (shaded:
> org.apache.james:apache-mime4j-core:0.8.1){_})
> CVE Summary -
> _"In Apache James, using Jazzer fuzzer, we identified that an IMAP user can
> craft IMAP LIST commands to orchestrate a Denial Of Service using a
> vulnerable Regular expression. This affected Apache James prior to 3.6.1 We
> recommend upgrading to Apache James 3.6.1 or higher , which enforce the use
> of RE2J regular expression engine to execute regex in linear time without
> back-tracking."_
> [https://nvd.nist.gov/vuln/detail/CVE-2021-40110#vulnCurrentDescriptionTitle]
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
