Threats tagged 'ghsa-pm2h-xjj9-fw84'

hMailServer versions 6.3.4 through 6.3.7, when configured with a MySQL or MariaDB database using TlsMode=verify-full but without specifying a TlsCaFile, do not properly verify the database server's certificate issuer or name for connections treated as local by MariaDB Connector/C. This allows a local attacker who can impersonate the database server to intercept database credentials and manipulate traffic between hMailServer and the database. The issue arises because MariaDB Connector/C versions 3.4.1 and later accept any valid self-signed certificate without proper verification in these local connection scenarios. The default configuration is not affected as TlsMode defaults to prefer, which does not enforce certificate verification.