Threats tagged 'ghsa-2q54-5c4c-vg9w'

Progressive Robot hMailServer versions 6.0.0-B1 through 6.3.7 on Windows improperly handle TLS file names by passing them as Latin-1 bytes to OpenSSL, which interprets them as UTF-8. This mismatch allows a local attacker with file creation permissions to substitute TLS-related files, enabling unauthorized client certificate acceptance, interception and modification of stored messages, exposure of ACME client private keys, or denial of TLS port startup. The vulnerability requires non-default configurations such as non-ASCII file names and enabled client certificates. Linux builds are not affected.