Threats tagged 'ghsa-874v-49pf-3wjr'

Progressive Robot hMailServer versions 6.3.3 through 6.3.7 have a vulnerability in the web services listener related to how failed CardDAV, CalDAV, or Autodiscover sign-ins from trusted proxies are counted. The listener counts failed sign-ins against the proxy's IP address rather than the actual client, potentially causing the proxy's address to be auto-banned from the server's mail listeners. This can result in denial of service for legitimate mail clients behind the proxy. The listener is off by default and uses HTTP Basic authentication over HTTPS for these services. The auto-ban feature is enabled by default, and no patch or fixed versions are explicitly stated.