Summary
It was discovered that the nginx ngx_mail_smtp_module module incorrectly
handled certain memory operations when doing SMTP authentication. This
could possibly result in sensitive information being sent to the
authentication server.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | nginx | 1.18.0-6ubuntu14.7 |
| Ubuntu · 24.04 LTS 24.04:LTS | nginx | 1.24.0-2ubuntu7.5 |
Vulnerabilities 1
-
Low 3.7
NGINX ngx_mail_smtp_module vulnerability
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to th…
References
-
report
https://ubuntu.com/security/CVE-2025-53859