CVSS 3.7 · Low EPSS 0,26%
Kerentanan Improper Neutralization of CRLF Sequences ('CRLF Injection') pada f5 nginx plus, f5 nginx open source. Skor CVSS 3.1 3.7 (Low) menurut f5.com.
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| f5 | nginx plus | Versi r32 p1 |
| f5 | nginx plus | Versi r32 p2 |
| f5 | nginx plus | Versi r32 p3 |
| f5 | nginx plus | Versi r32 p4 |
| f5 | nginx plus | Versi r33 |
| f5 | nginx plus | Versi r33 p1 |
| f5 | nginx plus | Versi r33 p2 |
| f5 | nginx plus | Versi r33 p3 |
| f5 | nginx plus | Versi r34 |
| f5 | nginx plus | Versi r34 p1 |
| f5 | nginx plus | Versi r34 p2 |
| f5 | nginx plus | Versi r35 |
| f5 | nginx plus | Versi r35 p1 |
| f5 | nginx plus | Versi r36 |
| f5 | nginx plus | Versi r36 p1 |
| f5 | nginx plus | Versi r36 p2 |
| f5 | nginx open source | Versi 0.6.27 hingga 0.9.7 |
| f5 | nginx open source | Versi 1.0.0 hingga sebelum 1.28.3 |
| f5 | nginx open source | Versi 1.29.0 hingga sebelum 1.29.7 |