Description (CNA)
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| F5 / NGINX Open Source | affected 1.29.0 before 1.29.7; affected 0.6.27 before 1.28.3 |
| F5 / NGINX Plus | affected R36 before R36 P3; affected R35 before R35 P2; affected R34 before *; affected R33 before *; affected R32 before R32 P5 |
CWE
CWE-93
References
ADP enrichment
No English description supplied.
No references supplied.