[<prev] [next>] [day] [month] [year] [list]
Message-ID: <0919e075-c31d-2613-26f3-d31146cc4861@apache.org>
Date: Wed, 05 Feb 2025 17:05:41 +0000
From: Benoit Tellier <btellier@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-45626: Apache James: denial of service through JMAP HTML
to text conversion
Affected versions:
- Apache James server 3.8.0 through 3.8.1
- Apache James server through 3.7.5
Description:
Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a denial of service.
Users are recommended to upgrade to version 3.7.6 and 3.8.2, which fix this issue.
Credit:
Benoit TELLIER (finder)
Wojciech Kapcia (finder)
References:
https://james.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-45626
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
