CVE-2021-40525: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

January 21, 2022 (updated February 8, 2022)

Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any file. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade. Distributed and Cassandra based products are also not impacted.

References

www.openwall.com/lists/oss-security/2022/01/04/4
www.openwall.com/lists/oss-security/2022/02/07/1
github.com/advisories/GHSA-c38m-7h53-g9v4
nvd.nist.gov/vuln/detail/CVE-2021-40525
www.openwall.com/lists/oss-security/2022/01/04/4

Code Behaviors & Features

Detect and mitigate CVE-2021-40525 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →