Merge pull request #36 from privacybydesign/fix-insecure-smtp-ssl

Fix CWE-297 - improper validation of certificate with host mismatch
privacybydesign · Nov 15, 2023 · 56b5891 · 56b5891
2 parents 1a6aef3 + 6d25bd4
commit 56b5891
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/src/main/java/foundation/privacybydesign/email/EmailSender.java b/src/main/java/foundation/privacybydesign/email/EmailSender.java
@@ -41,6 +41,8 @@ public static void send(String toAddresses, String subject, String body, String
         Session session;
         if (EmailConfiguration.getInstance().getMailUser().length() > 0) {
             props.put("mail.smtp.auth", "true");
+            props.put("mail.smtp.ssl.checkserveridentity", "true");
+
             session = Session.getInstance(props, new Authenticator() {
                 @Override
                 protected PasswordAuthentication getPasswordAuthentication() {