Bump com.sun.mail:jakarta.mail from 1.6.7 to 1.6.8.

[henricook]

Summary

• Bump com.sun.mail:jakarta.mail from 1.6.7 to 1.6.8

Version 1.6.7 is vulnerable to CVE-2025-7962, an SMTP injection flaw allowing attackers to inject arbitrary SMTP commands via \r\n characters in UTF-8 encoded input.

Binary compatibility

The fix in 1.6.8 is purely internal - a private validateCommand() method was added to SMTPTransport.sendCommand(). No public API was changed. The only other changes in 1.6.8 are an internal NTLM auth fix and logging improvements.

Diff of the security fix: eclipse-ee4j/mail@cc9b954

Confusing package naming in the CVE

From https://eclipse-ee4j.github.io/angus-mail/

August 18, 2021 - Jakarta Mail moves to Eclipse Angus
To break tight integration between Jakarta Mail Specification API and the implementation, sources of the implementation were moved to this project and further development continues here. Angus Mail is the direct successor of JavaMail/JakartaMail."

It might be wise for a future change to move away from the discontinued com.sun.mail:jakarta.mail namespace altogether.

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-7962
• GHSA-9342-92gg-6v29
• https://bugs.openjdk.org/browse/JDK-8024695

[henricook]

@garydgregory I hope this looks right for the backport, please LMK

[garydgregory]

@henricook

I fixed the Jacva 25+ failures the same way I did in master.

Please rebase on git master and I'll kick off another build.

The CVE refers to the Eclipse Angus libraries, not com.sun.mail, so the PR title is inappropriate.

[henricook]

@henricook

I fixed the Jacva 25+ failures the same way I did in master.

Please rebase on git master and I'll kick off another build.

The CVE refers to the Eclipse Angus libraries, not com.sun.mail, so the PR title is inappropriate.

Appreciate your work holding my hand on my first contrib here Gary! I've rebased now

[henricook]

The CVE refers to the Eclipse Angus libraries, not com.sun.mail, so the PR title is inappropriate.

I've updated the title and body to reflect what I think I've understood as a confusing situation where jakarta-mail now lives in the eclipse namespace.

[garydgregory]

@henricook

PR merged, thank you! 👍