Severity: High2021-12-08
When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers.
The Oxygen XML products incorporates the Apache Commons Email as a third-party library. This advisory was opened to address the potential impact of this third-party library vulnerability.
| Product | Severity | Fixed Release Availability |
| Oxygen Content Fusion 4.1 and older | High | Oxygen Content Fusion 4.1.2 build 2021112414 |
CVE-2017-9801
Severity: high
CVSS Score: 7.5
The Apache Commons Email third-party library used by Oxygen XML software products is an affected version mentioned in CVE-2017-9801 vulnerability description.
Starting with Oxygen Content Fusion version 4.1, the Apache Commons Email was updated to version 1.5, which includes a fix for CVE-2017-9801.
This website was created & generated with <oXygen/>®XML Editor
