oss-security - CVE-2024-37358: Apache James: denial of service through the use of IMAP literals

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <05da3e26-eacc-7a33-67aa-0a90d3bd51ae@apache.org>
Date: Wed, 05 Feb 2025 17:05:10 +0000
From: Benoit Tellier <btellier@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-37358: Apache James: denial of service through the use of
 IMAP literals 

Affected versions:

- Apache James server through 3.7.5
- Apache James server 3.8.0 through 3.8.1

Description:

Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated users, which could be used to cause unbounded memory allocation and very long computations

Version 3.7.6 and 3.8.2 restrict such illegitimate use of IMAP literals.

Credit:

Xavier GUIMARD (reporter)
Benoit TELLIER (coordinator)

References:

https://james.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-37358

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.