Description
Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. This issue affects Apache James MIME4J version 0.8.8 and prior versions.
We recommend users to upgrade to MIME4j version 0.8.9 or later.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache James MIME4J | ≤ 0.8.8 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 18.0.7-1.redhat_00001.1.el7sso | RHSA-2023:2707, RHSA-2023:2706, RHSA-2023:2705 |
| Red Hat JBoss EAP 7 | eap7-activemq-artemis-native | 1:1.0.2-3.redhat_00004.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-apache-mime4j | 0.8.9-1.redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-artemis-native +1 | 1:1.0.2-4.redhat_00004.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-artemis-wildfly-integration | 1.0.7-1.redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-infinispan +9 | 11.0.17-1.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.5.11-1.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.50-1.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-jboss-el-api_3.0_spec | 2.0.1-1.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-jboss-metadata +5 | 13.4.0-1.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +2 | 1.10.0-26.Final_redhat_00025.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-jbossws-cxf | 5.4.8-1.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-jbossws-spi | 3.4.0-2.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-netty +28 | 4.1.86-1.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-picketlink-api +7 | 2.5.5-22.SP12_redhat_00012.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-resteasy +18 | 3.15.5-1.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-snakeyaml | 1.33.0-2.SP1_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.2.23-1.SP2_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-undertow-jastow | 2.0.14-1.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-wildfly +4 | 7.4.10-6.GA_redhat_00002.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.1.16-1.Final_redhat_00002.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk17 | 7.4.10-6.GA_redhat_00002.1.el8eap | RHSA-2023:1514, RHSA-2023:1513 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.james:apache-mime4j-storage | < 0.8.9 | 0.8.9 | GHSA-q84x-3476-8ff2 |
Advisories 9
- RHSA-2023:2706 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.3 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:2707 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.3 security update on RHEL 9 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:2705 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.3 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:1514 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 9 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:1512 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:1513 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2023-1193 Red Hat Single Sign On: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 10, 2025
- WID-SEC-2023-0308 IBM WebSphere Application Server Liberty: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Feb 27, 2024
- WID-SEC-2023-1812 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 20, 2023
References
- https://lists.apache.org/thread/26s8p9stl1z261c4qw15bsq03tt7t0rj vendor-advisory