You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@james.apache.org by bt...@apache.org on 2026/10/17 13:53:53 UTC
(james-project) branch master updated: [SECURITY] 3.9.1 security announcements (#3256)
This is an automated email from the ASF dual-hosted git repository.
chibenwa pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/james-project.git
The following commit(s) were added to refs/heads/master by this push:
new 07c9ed929d [SECURITY] 3.9.1 security announcements (#3256)
07c9ed929d is described below
commit 07c9ed929d9ebb91988ad35a8fa33bb25a1fa03a
Author: Benoit TELLIER <bt...@linagora.com>
AuthorDate: Sat Oct 17 15:53:48 2026 +0200
[SECURITY] 3.9.1 security announcements (#3256)
---
CHANGELOG.md | 13 ++++++
.../modules/servers/partials/operate/security.adoc | 46 +++++++++++++++++++++-
.../_posts/2026-09-25-james-3.9.1.markdown | 13 ++++++
src/site/xdoc/server/feature-security.xml | 44 ++++++++++++++++++++-
4 files changed, 114 insertions(+), 2 deletions(-)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a6865b7458..4e718d1b99 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -174,6 +174,19 @@ No changes yet.
## [3.9.1] - 2026-09-25
+### Security
+
+This release addresses the following CVEs:
+
+ - CVE-2025-66621 SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred
+ - CVE-2026-49939 Negative IMAP ACL administer authorization bypass through JMAP protocol
+ - CVE-2026-74756 WebAdmin exposed without authentication on official Docker default
+ - CVE-2026-76168 ManageSieve file implementation cross-user path traversal
+ - CVE-2026-76171 SSRF filter bypass in the JMAP PushSubscription web-push client
+ - CVE-2026-85111 Denial of service upon MIME parsing
+
+Users are recommended to upgrade to 3.9.1 which addresses those issues.
+
### Removals
- Drop Glowroot integration: the Glowroot agent is no longer shipped within James docker images, nor configurable
diff --git a/docs/modules/servers/partials/operate/security.adoc b/docs/modules/servers/partials/operate/security.adoc
index 17226b13cd..6ff49cb540 100644
--- a/docs/modules/servers/partials/operate/security.adoc
+++ b/docs/modules/servers/partials/operate/security.adoc
@@ -294,4 +294,48 @@ This issue can be mitigated by:
- Possibly running James in a container
- Disabling JMX all-together (Guice only)
-Read more link:http://james.apache.org//james/update/2017/10/20/james-3.0.1.html[here].
\ No newline at end of file
+Read more link:http://james.apache.org//james/update/2017/10/20/james-3.0.1.html[here].
+
+=== CVE-2025-66621 SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred
+
+Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured.
+
+This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so.
+
+We recommend users to upgrade to non vulnerable version that forces explicit configuration of aud claims and forces introspection.
+
+=== CVE-2026-49939 Negative IMAP ACL administer authorization bypass through JMAP protocol
+
+In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol.
+
+This results in users being able to administer folders in JMAP despite having being explicitly denied the right to do so in IMAP.
+
+Users are recommended to upgrade to version 3.9.1 which fixes this issue.
+
+=== CVE-2026-74756 WebAdmin exposed without authentication on official Docker default
+
+Some docker-compose shipped by the project exposes by default Webadmin REST API publically without proper authentication setup.
+
+Version 3.9.1 onward sets a random credential by default on unprotected webadmin endpoints to prevent this while retain convenience.
+
+=== CVE-2026-76168 ManageSieve file implementation cross-user path traversal
+
+In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users.
+
+This allows a logged in attacker to set arbitrary SIEVE scripts for other users, resulting in denial of service or even traffic capture.
+
+Users are recommended to upgrade to version 3.9.1 which fixes this issue.
+
+=== CVE-2026-76171 SSRF filter bypass in the JMAP PushSubscription web-push client
+
+In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF validation did lead to the possibility to reach internal addresses.
+
+Users are recommended to upgrade to version 3.9.1 which fixes this issue.
+
+=== CVE-2026-85111 Denial of service upon MIME parsing
+
+Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages.
+
+Users are recommended to upgrade to Apache James server 3.9.1 that relies on fixed MIME4J 0.8.15 which addresses the issue.
+
+See CVE-2026-85108 in Apache James MIME4J library.
diff --git a/src/homepage/_posts/2026-09-25-james-3.9.1.markdown b/src/homepage/_posts/2026-09-25-james-3.9.1.markdown
index ea5db21b75..865dd4f9d3 100644
--- a/src/homepage/_posts/2026-09-25-james-3.9.1.markdown
+++ b/src/homepage/_posts/2026-09-25-james-3.9.1.markdown
@@ -11,6 +11,19 @@ Early adopters can [download it][download], any issue can be reported on our iss
The Apache James PMC would like to thank all contributors who made this release possible!
+## Security
+
+This release addresses the following CVEs:
+
+ - CVE-2025-66621 SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred
+ - CVE-2026-49939 Negative IMAP ACL administer authorization bypass through JMAP protocol
+ - CVE-2026-74756 WebAdmin exposed without authentication on official Docker default
+ - CVE-2026-76168 ManageSieve file implementation cross-user path traversal
+ - CVE-2026-76171 SSRF filter bypass in the JMAP PushSubscription web-push client
+ - CVE-2026-85111 Denial of service upon MIME parsing
+
+Users are recommended to upgrade to 3.9.1 which addresses those issues.
+
## Announcement
This maintenance release brings numerous bug fixes, security enhancements and dependency upgrades to the 3.9.x line.
diff --git a/src/site/xdoc/server/feature-security.xml b/src/site/xdoc/server/feature-security.xml
index cebf614e5c..967c809343 100644
--- a/src/site/xdoc/server/feature-security.xml
+++ b/src/site/xdoc/server/feature-security.xml
@@ -61,6 +61,48 @@
<a href="https://apache.org/security/committers.html#vulnerability-handling">vulnerability handling</a>.
</subsection>
+ <subsection name="CVE-2025-66621: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred">
+ <p>Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured.</p>
+
+ <p>This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so.</p>
+
+ <p><b>Mitigation</b>: We recommend users to upgrade to non vulnerable version that forces explicit configuration of aud claims and forces introspection.</p>
+ </subsection>
+
+ <subsection name="CVE-2026-49939: Negative IMAP ACL administer authorization bypass through JMAP protocol">
+ <p>In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol.</p>
+
+ <p>This results in users being able to administer folders in JMAP despite having being explicitly denied the right to do so in IMAP.</p>
+
+ <p><b>Mitigation</b>: Users are recommended to upgrade to version 3.9.1 which fixes this issue.</p>
+ </subsection>
+
+ <subsection name="CVE-2026-74756: WebAdmin exposed without authentication on official Docker default">
+ <p>Some docker-compose shipped by the project exposes by default Webadmin REST API publically without proper authentication setup.</p>
+
+ <p><b>Mitigation</b>: Version 3.9.1 onward sets a random credential by default on unprotected webadmin endpoints to prevent this while retain convenience.</p>
+ </subsection>
+
+ <subsection name="CVE-2026-76168: ManageSieve file implementation cross-user path traversal">
+ <p>In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users.</p>
+
+ <p>This allows a logged in attacker to set arbitrary SIEVE scripts for other users, resulting in denial of service or even traffic capture.</p>
+
+ <p><b>Mitigation</b>: Users are recommended to upgrade to version 3.9.1 which fixes this issue.</p>
+ </subsection>
+
+ <subsection name="CVE-2026-76171: SSRF filter bypass in the JMAP PushSubscription web-push client">
+ <p>In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF validation did lead to the possibility to reach internal addresses.</p>
+
+ <p><b>Mitigation</b>: Users are recommended to upgrade to version 3.9.1 which fixes this issue.</p>
+ </subsection>
+
+ <subsection name="CVE-2026-85111: Denial of service upon MIME parsing">
+ <p>Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages.</p>
+
+ <p><b>Mitigation</b>: Users are recommended to upgrade to Apache James server 3.9.1 that relies on fixed MIME4J 0.8.15 which addresses the issue.</p>
+ </subsection>
+
<subsection name="CVE-2024-37358: Denial of service through the use of IMAP literals">
<p> Apache James prior to versions 3.8.2 or 3.7.6 allows an attacker
to trigger a denial of service by exploiting IMAP literals.</p>
@@ -217,4 +259,4 @@
</body>
-</document>
\ No newline at end of file
+</document>
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@james.apache.org
For additional commands, e-mail: notifications-help@james.apache.org