Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-7962: In Jakarta Mail 2.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | jakarta-mail | 0:1.6.5-8.amzn2023.0.2 |
Vulnerabilities 1
-
Medium 6.0
Jakarta Mail vulnerable to SMTP Injection
In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-7962.html