p PatchFirst

CVE-2025-53859

CVE-2025-53859 · NGINX ngx_mail_smtp_module vulnerability

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method "none," and (3) the authentication server returns the "Auth-Wait" response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 6.3 · Media · EPSS 0,4% · Corrección disponible

Publicación
Actualización

Pila tecnológica: system · web

Productos y versiones afectados

  • nginx plus

    Versiones
    • R35: No afectada (custom)
    • ≥ R34, < R34 P2: Afectada (custom)
    • ≥ R33, < R33 P3: Afectada (custom)
    • ≥ R32, < R32 P3: Afectada (custom)
    • ≥ R31: Afectada (custom)
    • ≥ R30: Afectada (custom)

    Sin corrección publicada

  • nginx

    Versiones
    • ≥ 0.7, < 1.29.1: Afectada (custom)

    Actualiza a 1.29.1

  • nginx Debian:12

    Versiones
    • 1.22.1-9
    • 1.22.1-9+deb12u1
    • 1.22.1-9+deb12u2
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1.22.1-9+deb12u3

    Actualiza a 1.22.1-9+deb12u3

  • nginx Debian:13

    Versiones
    • 1.26.3-3
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1.26.3-3+deb13u1

    Actualiza a 1.26.3-3+deb13u1

  • nginx Debian:14

    Versiones
    • 1.26.3-3
    • 1.28.0-1
    • 1.28.0-2
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1.28.0-3

    Actualiza a 1.28.0-3

  • nginx Ubuntu:Pro:14.04:LTS

    Versiones
    • 1.4.1-3ubuntu1
    • 1.4.3-2ubuntu1
    • 1.4.4-1ubuntu1
    • 1.4.4-2ubuntu1
    • 1.4.4-4ubuntu1
    • 1.4.5-1ubuntu1
    • 1.4.6-1ubuntu2
    • 1.4.6-1ubuntu3
    • 1.4.6-1ubuntu3.1
    • 1.4.6-1ubuntu3.2
    • 1.4.6-1ubuntu3.3
    • 1.4.6-1ubuntu3.4
    • 1.4.6-1ubuntu3.5
    • 1.4.6-1ubuntu3.6
    • 1.4.6-1ubuntu3.7
    • 1.4.6-1ubuntu3.8
    • 1.4.6-1ubuntu3.9
    • 1.4.6-1ubuntu3.9+esm1
    • 1.4.6-1ubuntu3.9+esm2
    • 1.4.6-1ubuntu3.9+esm3
    • 1.4.6-1ubuntu3.9+esm4
    • 1.4.6-1ubuntu3.9+esm5
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1.4.6-1ubuntu3.9+esm6

    Actualiza a 1.4.6-1ubuntu3.9+esm6

  • nginx Ubuntu:Pro:16.04:LTS

    Versiones
    • 1.9.3-1ubuntu1
    • 1.9.6-2ubuntu1
    • 1.9.6-2ubuntu2
    • 1.9.9-0ubuntu1
    • 1.9.9-1ubuntu1
    • 1.9.10-0ubuntu1
    • 1.9.10-1ubuntu1
    • 1.9.11-0ubuntu1
    • 1.9.11-0ubuntu2
    • 1.9.12-0ubuntu1
    • 1.9.13-0ubuntu1
    • 1.9.14-0ubuntu1
    • 1.9.15-0ubuntu1
    • 1.10.0-0ubuntu0.16.04.1
    • 1.10.0-0ubuntu0.16.04.2
    • 1.10.0-0ubuntu0.16.04.3
    • 1.10.0-0ubuntu0.16.04.4
    • 1.10.3-0ubuntu0.16.04.1
    • 1.10.3-0ubuntu0.16.04.2
    • 1.10.3-0ubuntu0.16.04.3
    • 1.10.3-0ubuntu0.16.04.4
    • 1.10.3-0ubuntu0.16.04.5
    • 1.10.3-0ubuntu0.16.04.5+esm1
    • 1.10.3-0ubuntu0.16.04.5+esm2
    • 1.10.3-0ubuntu0.16.04.5+esm3
    • 1.10.3-0ubuntu0.16.04.5+esm4
    • 1.10.3-0ubuntu0.16.04.5+esm5
    • 1.10.3-0ubuntu0.16.04.5+esm6
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1.10.3-0ubuntu0.16.04.5+esm7

    Actualiza a 1.10.3-0ubuntu0.16.04.5+esm7

  • nginx Ubuntu:Pro:18.04:LTS

    Versiones
    • 1.12.1-0ubuntu2
    • 1.13.6-2ubuntu1
    • 1.13.6-2ubuntu2
    • 1.13.10-1ubuntu1
    • 1.13.12-0ubuntu1
    • 1.14.0-0ubuntu1
    • 1.14.0-0ubuntu1.1
    • 1.14.0-0ubuntu1.2
    • 1.14.0-0ubuntu1.3
    • 1.14.0-0ubuntu1.4
    • 1.14.0-0ubuntu1.5
    • 1.14.0-0ubuntu1.6
    • 1.14.0-0ubuntu1.7
    • 1.14.0-0ubuntu1.9
    • 1.14.0-0ubuntu1.10
    • 1.14.0-0ubuntu1.11
    • 1.14.0-0ubuntu1.11+esm1
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1.14.0-0ubuntu1.11+esm2

    Actualiza a 1.14.0-0ubuntu1.11+esm2

  • nginx Ubuntu:Pro:20.04:LTS

    Versiones
    • 1.16.1-0ubuntu2
    • 1.16.1-0ubuntu3
    • 1.17.5-0ubuntu1
    • 1.17.6-0ubuntu1
    • 1.17.7-0ubuntu1
    • 1.17.8-0ubuntu1
    • 1.17.8-0ubuntu2
    • 1.17.8-0ubuntu3
    • 1.17.9-0ubuntu1
    • 1.17.9-0ubuntu2
    • 1.17.9-0ubuntu3
    • 1.17.10-0ubuntu1
    • 1.18.0-0ubuntu1
    • 1.18.0-0ubuntu1.2
    • 1.18.0-0ubuntu1.3
    • 1.18.0-0ubuntu1.4
    • 1.18.0-0ubuntu1.5
    • 1.18.0-0ubuntu1.6
    • 1.18.0-0ubuntu1.7
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1.18.0-0ubuntu1.7+esm1

    Actualiza a 1.18.0-0ubuntu1.7+esm1

  • nginx Ubuntu:22.04:LTS

    Versiones
    • 1.18.0-6ubuntu11
    • 1.18.0-6ubuntu12
    • 1.18.0-6ubuntu14
    • 1.18.0-6ubuntu14.1
    • 1.18.0-6ubuntu14.2
    • 1.18.0-6ubuntu14.3
    • 1.18.0-6ubuntu14.4
    • 1.18.0-6ubuntu14.5
    • 1.18.0-6ubuntu14.6
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1.18.0-6ubuntu14.7

    Actualiza a 1.18.0-6ubuntu14.7

  • nginx Ubuntu:24.04:LTS

    Versiones
    • 1.24.0-1ubuntu1
    • 1.24.0-2ubuntu1
    • 1.24.0-2ubuntu2
    • 1.24.0-2ubuntu3
    • 1.24.0-2ubuntu4
    • 1.24.0-2ubuntu6
    • 1.24.0-2ubuntu7
    • 1.24.0-2ubuntu7.1
    • 1.24.0-2ubuntu7.3
    • 1.24.0-2ubuntu7.4
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1.24.0-2ubuntu7.5

    Actualiza a 1.24.0-2ubuntu7.5

  • nginx Ubuntu:25.10

    Versiones
    • 1.26.3-2ubuntu1
    • 1.26.3-3ubuntu1
    • 1.26.3-3ubuntu2
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1.26.3-3ubuntu3

    Actualiza a 1.26.3-3ubuntu3

Fuentes originales

Comprueba tu servidor →