Threats tagged 'ghsa-2qmj-q2xc-85v8'

NGINX Open Source and NGINX Plus have a low-severity vulnerability in the ngx_mail_smtp_module that may allow an unauthenticated attacker to over-read memory during the SMTP authentication process. This can lead to leakage of arbitrary bytes sent in a request to the authentication server. The vulnerability requires specific conditions: NGINX must be built with ngx_mail_smtp_module, the smtp_auth directive configured with method "none," and the authentication server returning the "Auth-Wait" response header. No known exploits are reported in the wild, and no patch information is provided.