Summary
generated automatically from NVD dataThe SMTP proxy in nginx (1.5.x, 1.6.x before 1.6.1, and 1.7.x before 1.7.4) has a flaw in its STARTTLS implementation in mail/ngx_mail_smtp_handler.c, which does not properly restrict I/O buffering. A man-in-the-middle attacker can send a cleartext command that is processed after TLS is established, injecting commands into encrypted SMTP sessions, a "plaintext command injection" attack similar to CVE-2011-0411. It is classed as CWE-77 and has a CVSS v2.0 score of 6.8 (MEDIUM).
NVD description
The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and 1.7.x before 1.7.4 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
EPSS · FIRST.org
7.8%probability of exploitation in the next 30 days
Higher than 94% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-11-02, recomputed daily by FIRST.org.
CVSS v2.0 Score
Information
- Published
- 29 déc. 2014
- Updated
- 17 juin 2026
- Status
- Modified
- Source
- secalert@redhat.com
Affected products
Bounds published by NVD: "< 8.4.27" means 8.4.27 is no longer vulnerable. The fixed release to install is in the vendor advisory.
Weaknesses (CWE)
References (8)
- http://mailman.nginx.org/pipermail/nginx-announce/2014/000144.htmlPatchVendor Advisory
- http://marc.info/?l=bugtraq&m=142103967620673&w=2Issue TrackingThird Party Advisory
- http://nginx.org/download/patch.2014.starttls.txtPatchVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1126891Issue TrackingThird Party Advisory
- http://mailman.nginx.org/pipermail/nginx-announce/2014/000144.htmlPatchVendor Advisory
- http://marc.info/?l=bugtraq&m=142103967620673&w=2Issue TrackingThird Party Advisory
- http://nginx.org/download/patch.2014.starttls.txtPatchVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1126891Issue TrackingThird Party Advisory
Similar CVEs
Other vulnerabilities of type CWE-77
Running nginx? Know which CVEs hit your version.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.