Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2021-44549— SMTPS server hostname not checked when making TLS connection to SMTPS server

Quick assessment

Affected
Apache Software Foundation Apache Sling Commons Messaging Mail
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Sling Commons Messaging Mail是美国Apache基金会的一款开源消息传递邮件服务。 Apache Sling Commons Messaging Mail 存在安全漏洞，该漏洞源于 Apache Sling Commons Messaging Mail 在 JavaMail/Jakarta Mail 之上为 OSGi 提供了一个简单的层，用于通过 SMTPS 发送邮件。为了降低中间人攻击的风险，在访问邮件服务器时必须执行额外的服务器身份检查。出于兼容性原因，Java

AI Predicted 6.5 Difficulty: Moderate EPSS 2.08% · P81

Possible ATT&CK Techniques 1 AI

T1078 · Valid Accounts
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-44549

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SMTPS server hostname not checked when making TLS connection to SMTPS server
Source: CVE Program / CVE List V5
Vulnerability Description
Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these additional checks are disabled by default in JavaMail/Jakarta Mail. The SimpleMailService in Apache Sling Commons Messaging Mail 1.0 lacks an option to enable these checks for the shared mail session. A user could enable these checks nevertheless by accessing the session via the message created by SimpleMessageBuilder and setting the property mail.smtps.ssl.checkserveridentity to true. Apache Sling Commons Messaging Mail 2.0 adds support for enabling server identity checks and these checks are enabled by default. - https://javaee.github.io/javamail/docs/SSLNOTES.txt - https://javaee.github.io/javamail/docs/api/com/sun/mail/smtp/package-summary.html - https://github.com/eclipse-ee4j/mail/issues/429
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Sling Commons Messaging Mail 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Sling Commons Messaging Mail是美国Apache基金会的一款开源消息传递邮件服务。 Apache Sling Commons Messaging Mail 存在安全漏洞，该漏洞源于 Apache Sling Commons Messaging Mail 在 JavaMail/Jakarta Mail 之上为 OSGi 提供了一个简单的层，用于通过 SMTPS 发送邮件。为了降低中间人攻击的风险，在访问邮件服务器时必须执行额外的服务器身份检查。出于兼容性原因，Java
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache Sling Commons Messaging Mail Apache Sling Commons Messaging Mail 1.0.0 1.0.0 -

II. Public POCs for CVE-2021-44549

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-44549

请登录查看更多情报信息。

Mailing List Discussions for CVE-2021-44549 (1)

Same Patch Batch · Apache Software Foundation · 2021-12-14 · 3 CVEs total

CVE-2021-4104 Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2
CVE-2021-45046 Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a de

IV. Related Vulnerabilities

Same vendor: Apache Software Foundation
Same weakness: CWE-295

V. Comments for CVE-2021-44549

No comments yet

Leave a comment