[jira] [Resolved] (TOMEE-3838) TomEE Plume - CVE-2021-40110

["Richard Zowalla (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/TOMEE-3838?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Richard Zowalla resolved TOMEE-3838.
------------------------------------
      Assignee: Richard Zowalla
    Resolution: Invalid

After discussing this with [~jlmonteiro], we both came to the conclusion, that TomEE is *not* impacted by CVE-2021-40110 as this is a Apache James Server specific vulnerability, which doesn't relate to apache-mime4j-core shaded in Geronimo Mail 1.0.1, which is used in TomEE.

> TomEE Plume - CVE-2021-40110
> ----------------------------
>
>                 Key: TOMEE-3838
>                 URL: https://issues.apache.org/jira/browse/TOMEE-3838
>             Project: TomEE
>          Issue Type: Bug
>          Components: TomEE Core Server
>    Affects Versions: 8.0.9
>            Reporter: AJIT GOPALAN
>            Assignee: Richard Zowalla
>            Priority: Blocker
>
> TomEE Plume 8.0.9 suffers from CVE-2021-40110
> This is a bug in Apache James, that manifests itself through the Geronimo Mail jar dependency in TomEE ({_}layer.tar: apache-tomee-8.0.9-plume.tar.gz: apache-tomee-8.0.9-plume.tar: geronimo-javamail_1.6_mail-1.0.1.jar (shaded: org.apache.james:apache-mime4j-core:0.8.1){_})
> CVE Summary - 
> _"In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a Denial Of Service using a vulnerable Regular expression. This affected Apache James prior to 3.6.1 We recommend upgrading to Apache James 3.6.1 or higher , which enforce the use of RE2J regular expression engine to execute regex in linear time without back-tracking."_
> [https://nvd.nist.gov/vuln/detail/CVE-2021-40110#vulnCurrentDescriptionTitle]



--
This message was sent by Atlassian Jira
(v8.20.1#820001)