Vulnerability · Published Jul 26, 2021 · Assigned by apache
CVE-2021-33900StartTLS and SASL confidentiality protection bypass
High 7.5
In plain English
A high-severity security flaw in Apache Directory Studio from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
While investigating DIRSTUDIO-1219 it was noticed that configured StartTLS encryption was not applied when any SASL authentication mechanism (DIGEST-MD5, GSSAPI) was used. While investigating DIRSTUDIO-1220 it was noticed that any configured SASL confidentiality layer was not applied. This issue affects Apache Directory Studio version 2.0.0.v20210213-M16 and prior versions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.directory.studio:org.apache.directory.studio.parent | 2.0.0.v20210717-M17 | GHSA-4x25-f45x-grv5 |
| Ubuntu:22.04:LTS | apache-directory-server | no fix listed | UBUNTU-CVE-2021-33900 |
| Ubuntu:24.04:LTS | apache-directory-server | no fix listed | UBUNTU-CVE-2021-33900 |
| Ubuntu:25.10 | apache-directory-server | no fix listed | UBUNTU-CVE-2021-33900 |
| Ubuntu:26.04:LTS | apache-directory-server | no fix listed | UBUNTU-CVE-2021-33900 |
| Ubuntu:26.10 | apache-directory-server | no fix listed | UBUNTU-CVE-2021-33900 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Directory Studio | unspecified – through 2.0.0.v20210213-M16 |
Weakness: CWE-311