Read the docs
TI-2021-20145 Aliases CVE-2021-44549GHSA-c69w-jj56-834w

SMTPS server hostname not checked when making TLS connection to SMTPS server

Priority LOW 37CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 5 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295.

Summary

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these additional checks are disabled by default in JavaMail/Jakarta Mail. The SimpleMailService in Apache Sling Commons Messaging Mail 1.0 lacks an option to enable these checks for the shared mail session. A user could enable these checks nevertheless by accessing the session via the message created by SimpleMessageBuilder and setting the property mail.smtps.ssl.checkserveridentity to true. Apache Sling Commons Messaging Mail 2.0 adds support for enabling server identity checks and these checks are enabled by default. - https://javaee.github.io/javamail/docs/SSLNOTES.txt - https://javaee.github.io/javamail/docs/api/com/sun/mail/smtp/package-summary.html - https://github.com/eclipse-ee4j/mail/issues/429

Why it matters now

EPSS 0.02081 81st percentileScored 2026-11-07
Fix Partial org.apache.sling:org.apache.sling.commons.messaging.mail (Maven): 2.0Red Hat: 6 advisoriesRed Hat: 5 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Sling Commons Messaging MailApache Sling Commons Messaging Mail 1.0.0 1.0.0—No fix listedCNA
—org.apache.sling:org.apache.sling.commons.messaging.mail (Maven)before 2.02.0Patch availableGHSA-c69w-jj56-834w
  • Apache Sling Commons Messaging Mail VendorApache Affected Apache Sling Commons Messaging Mail 1.0.0 1.0.0 Fixed in — No fix listed CNA
  • org.apache.sling:org.apache.sling.commons.messaging.mail (Maven) Vendor— Affected before 2.0 Fixed in 2.0 Patch available GHSA-c69w-jj56-834w

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:sling_commons_messaging_mail:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableApache
  • cpe:2.3:a:apache:sling_commons_messaging_mail:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-c69w-jj56-834w org.apache.sling:org.apache.sling.commons.messaging.mail (Maven) Fixed in 2.0 Advisory →

Red Hat 6 advisories

  • RHSA-2024:8887 Released 2024-11-05 · Red Hat rating Important
    Red Hat Product OCP Tools 4.13 Openshift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins-4.13.1729840148-1.el8, jenkins-2.462.3.1729839924-3.el8
  • RHSA-2024:8886 Released 2024-11-05 · Red Hat rating Important
    Red Hat Product OCP Tools 4.12 Openshift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1730119231-1.el8, jenkins-2.462.3.1730119132-3.el8
  • RHSA-2024:8885 Released 2024-11-05 · Red Hat rating Important
    Red Hat Product OCP Tools 4.14 Openshift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.14 jenkins-2-plugins-4.14.1729839844-1.el8, jenkins-2.462.3.1729839727-3.el8
Show 3 more Red Hat advisories
  • RHSA-2024:8884 Released 2024-11-05 · Red Hat rating Important
    Red Hat Product OCP Tools 4.15 Openshift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.15 jenkins-2-plugins-4.15.1729838165-1.el8, jenkins-2.462.3.1729837947-3.el8
  • RHSA-2024:7676 Released 2024-10-10 · Red Hat rating Critical
    Red Hat build of Quarkus 3.2.12.SP1 Security Update
    • Red Hat build of Quarkus Native builder
  • RHSA-2024:7670 Released 2024-10-10 · Red Hat rating Critical
    Red Hat build of Quarkus 3.8.6.SP1 Security Update
    • Red Hat build of Quarkus Native builder

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Build of KeycloakAffectedNo fix planned: Will not fix
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix planned: Will not fix
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix yet
OpenShift Developer Tools and Services for OCP 4.12Fixed RHSA-2024:8886
OpenShift Developer Tools and Services for OCP 4.13Fixed RHSA-2024:8887
OpenShift Developer Tools and Services for OCP 4.14Fixed RHSA-2024:8885
OpenShift Developer Tools and Services for OCP 4.15Fixed RHSA-2024:8884
Red Hat build of Quarkus Native builderFixed RHSA-2024:7676
Not affected: 3 products
  • OpenShift Serverless
  • Red Hat Data Grid 8
  • Red Hat JBoss Enterprise Application Platform 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-44549
  2. 2026-10-03 Alias added: GHSA-c69w-jj56-834w
  3. 2026-10-20 Fix available: Red Hat build of Quarkus Native builder · Red Hat

References

Advisory 2

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences