[SLING-10965] Support server identity check

• Type: New Feature
• Status: Closed
• Priority: Critical
• Resolution: Done
• Fix Version/s: Commons Messaging Mail 2.0.0
• Component/s: Commons
• Assignee: Oliver Lietz
• Reporter: Oliver Lietz
• Created: 03/Dec/21 14:52
• Updated: 16/Dec/21 08:56
• Resolved: 03/Dec/21 14:57

Description

This new feature adds support for enabling server identity checks and these checks are enabled by default.

A security issue ("SMTPS server hostname not checked when making TLS connection to SMTPS server") was reported by Michael Lescisin and accepted by the project. The issue is tracked as CVE-2021-44549.

The checks are still not enabled by default in the underlying Jakarta Mail, see Hostname validation for certificates should be enabled by default.

The SimpleMailService in Apache Sling Commons Messaging Mail 1.0 lacks an option to enable these checks for the shared mail session.
A user could enable these checks nevertheless by accessing the session via the message created by SimpleMessageBuilder and setting the property mail.smtps.ssl.checkserveridentity to true:

    MimeMessage message = mailService.getMessageBuilder().build();
    message.getSession().getProperties().setProperty("mail.smtps.ssl.checkserveridentity", "true");

See also SSLNOTES:

Server Identity Check RFC 2595 specifies addition checks that must be performed on the server's certificate to ensure that the server you connected to is the server you intended to connect to. This reduces the risk of "man in the middle" attacks. For compatibility with earlier releases of Jakarta Mail, these additional checks are disabled by default. We strongly recommend that you enable these checks when using SSL. To enable these checks, set the "mail.<protocol>.ssl.checkserveridentity" property to "true".