CVE-2021-38542

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle command injection attacks, leading potentially to leakage of sensible information.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-77 CWE-327

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache James	>= Apache James, < 3.6.1

References

http://www.openwall.com/lists/oss-security/2022/01/04/1Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/09/20/1Mailing List, Third Party Advisory
https://www.openwall.com/lists/oss-security/2022/01/04/1Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/01/04/1Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/09/20/1Mailing List, Third Party Advisory
https://www.openwall.com/lists/oss-security/2022/01/04/1Mailing List, Third Party Advisory

Timeline

Published: Jan 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-385435.9TP-Link UE330 USB splitter devices through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equi CVE-2021-385445.9Sony SRS-XB33 and SRS-XB43 devices through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a tele CVE-2021-385455.9Raspberry Pi 3 B+ and 4 B devices through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equip CVE-2021-385465.9CREATIVE Pebble devices through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and a CVE-2021-385475.9Logitech Z120 and S120 speakers through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telesco CVE-2021-385485.9JBL Go 2 devices through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an elect CVE-2021-385495.9MIRACASE MHUB500 USB splitters through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equipmen CVE-2021-38558.8Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Liman Central Management System Liman M CVE-2021-385534.4HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feat CVE-2021-385545.3HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fi CVE-2021-385559.1An XML external entity (XXE) injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions CVE-2021-385568.8includes/configure_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection.