CVE-2021-44549: Improper Certificate Validation and Improper Validation of Certificate with Host Mismatch in Apache Sling Commons Messaging Mail
Summary
CVE-2021-44549: Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. Affects org.apache.sling:org.apache.sling.commons.messaging.mail versions < 2.0. Fixed in 2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Sling Commons Messaging Mail is a library that provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. It is commonly used in Java applications for email functionality. However, this library is vulnerable to improper certificate validation and improper validation of certificates with host mismatch.
Vulnerability Detail
The vulnerability arises from the fact that additional server identity checks are disabled by default in JavaMail/Jakarta Mail for compatibility reasons. The SimpleMailService in Apache Sling Commons Messaging Mail 1.0 lacks an option to enable these checks for the shared mail session. This allows an attacker to perform a "man in the middle" attack by intercepting and modifying the communication between the mail server and the application. Apache Sling Commons Messaging Mail 2.0 adds support for enabling server identity checks, which are enabled by default.
How To Fix
Minimum fixed version
2.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 2.0 is not feasible, users can manually enable server identity checks by accessing the session via the message created by SimpleMessageBuilder and setting the property 'mail.smtps.ssl.checkserveridentity' to true. However, this workaround is not recommended as it may introduce other security risks.
Conclusion
In conclusion, the Apache Sling Commons Messaging Mail library is vulnerable to improper certificate validation and improper validation of certificates with host mismatch. Users should upgrade to version 2.0 or later to fix this vulnerability. If upgrading is not feasible, users can manually enable server identity checks, but this is not recommended. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.sling:org.apache.sling.commons.messaging.mail →
FAQ
Apache Sling Commons Messaging Mail is a library that provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS.
This vulnerability allows an attacker to perform a "man in the middle" attack by intercepting and modifying the communication between the mail server and the application.
To fix this vulnerability, users should upgrade to Apache Sling Commons Messaging Mail 2.0 or later, where server identity checks are enabled by default.
A workaround is to manually enable server identity checks by setting the property 'mail.smtps.ssl.checkserveridentity' to true. However, this workaround is not recommended.
More information about this vulnerability can be found in the Apache Sling Commons Messaging Mail documentation and the JavaMail/Jakarta Mail documentation.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
