CVE-2021-44549

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these additional checks are disabled by default in JavaMail/Jakarta Mail. The SimpleMailService in Apache Sling Commons Messaging Mail 1.0 lacks an option to enable these checks for the shared mail session. A user could enable these checks nevertheless by accessing the session via the message created by SimpleMessageBuilder and setting the property mail.smtps.ssl.checkserveridentity to true. Apache Sling Commons Messaging Mail 2.0 adds support for enabling server identity checks and these checks are enabled by default. - https://javaee.github.io/javamail/docs/SSLNOTES.txt - https://javaee.github.io/javamail/docs/api/com/sun/mail/smtp/package-summary.html - https://github.com/eclipse-ee4j/mail/issues/429

• CWE-295
• CWE-295

• https://lists.apache.org/thread/l8p9h2bqvkj6rhv4w8kzctb817415b7fMailing List, Vendor Advisory
• https://lists.apache.org/thread/l8p9h2bqvkj6rhv4w8kzctb817415b7fMailing List, Vendor Advisory

Published

Dec 14, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-44542A memory leak vulnerability was found in Privoxy when handli…7.5
• CVE-2021-44543An XSS vulnerability was found in Privoxy which was fixed in…6.1
• CVE-2021-44544DIAEnergie Version 1.7.5 and prior is vulnerable to multiple…6.1
• CVE-2021-44545Improper input validation for some Intel(R) PROSet/Wireless …6.5
• CVE-2021-44547A sandboxing issue in Odoo Community 15.0 and Odoo Enterpris…9.1
• CVE-2021-44548An Improper Input Validation vulnerability in DataImportHand…9.8
• CVE-2021-4455The Wordpress Plugin Smart Product Review plugin for WordPre…9.8
• CVE-2021-44550An Incorrect Access Control vulnerability exists in CoreNLP …9.8
• CVE-2021-44554Thinfinity VirtualUI before 3.0 allows a malicious actor to …5.3
• CVE-2021-44556National Library of the Netherlands digger < 6697d1269d981e3…9.1
• CVE-2021-44557National Library of the Netherlands multiNER <= c0440948057a…9.1
• CVE-2021-4456Net::CIDR versions before 0.24 for Perl mishandle leading ze…6.5