Threats tagged 'ghsa-8g5c-c364-9965'

A vulnerability in Progressive Robot hMailServer versions 6.2.25 through 6.3.7 on Windows affects configurations using a PostgreSQL database with certain SSL modes and root certificate file settings. The issue arises from how the root certificate file name is handled with Windows code pages and UTF-8 encoding, allowing a local attacker to cause hMailServer to trust a malicious certificate authority. This enables interception and modification of database traffic, including the database password. The vulnerability does not affect default configurations and is specific to Windows builds with PostgreSQL or Oracle MySQL client libraries replacing the bundled MariaDB Connector/C.