{
  "document": {
    "aggregate_severity": {
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      },
      {
        "category": "details",
        "text": "* SECURITY UPDATE: inconsistent login/password storage in mail proxy\n     authentication after base64 decoding errors in the PLAIN, LOGIN and\n     CRAM-MD5 auth methods\n     - debian/patches/CVE-2025-53859.patch: decode into local buffers and\n       assign to the session login/passwd only on success in\n       src/mail/ngx_mail_handler.c\n     - CVE-2025-53859",
        "title": "Details"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1783434137",
        "url": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1783434137"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_docker/debian13/advisories/2026/clsa-2026_1783434137.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-07-07T14:23:08Z",
      "generator": {
        "date": "2026-07-07T14:23:08Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CLSA-2026:1783434137",
      "initial_release_date": "2026-07-07T14:23:08Z",
      "revision_history": [
        {
          "date": "2026-07-07T14:23:08Z",
          "number": "1",
          "summary": "Initial version"
        }
      ],
      "status": "final",
      "version": "1"
    },
    "title": "Fix CVE(s): CVE-2025-53859, CVE-2026-28755"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Debian 13",
                "product": {
                  "name": "Debian 13",
                  "product_id": "Debian-13",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:debian:debian_linux:13:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Debian"
          }
        ],
        "category": "vendor",
        "name": "Software in the Public Interest, Inc."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els10.amd64",
                "product": {
                  "name": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els10.amd64",
                  "product_id": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els10.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/nginx1.27@1.27.5-1~trixie%2Btuxcare.els10?arch=amd64&os_name=debian&os_version=13"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els8.amd64",
                "product": {
                  "name": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els8.amd64",
                  "product_id": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els8.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/nginx1.27@1.27.5-1~trixie%2Btuxcare.els8?arch=amd64&os_name=debian&os_version=13"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els5.amd64",
                "product": {
                  "name": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els5.amd64",
                  "product_id": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els5.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/nginx1.27@1.27.5-1~trixie%2Btuxcare.els5?arch=amd64&os_name=debian&os_version=13"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els2.amd64",
                "product": {
                  "name": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els2.amd64",
                  "product_id": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els2.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/nginx1.27@1.27.5-1~trixie%2Btuxcare.els2?arch=amd64&os_name=debian&os_version=13"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els1.amd64",
                "product": {
                  "name": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els1.amd64",
                  "product_id": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els1.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/nginx1.27@1.27.5-1~trixie%2Btuxcare.els1?arch=amd64&os_name=debian&os_version=13"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els10.arm64",
                "product": {
                  "name": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els10.arm64",
                  "product_id": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els10.arm64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/nginx1.27@1.27.5-1~trixie%2Btuxcare.els10?arch=arm64&os_name=debian&os_version=13"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els8.arm64",
                "product": {
                  "name": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els8.arm64",
                  "product_id": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els8.arm64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/nginx1.27@1.27.5-1~trixie%2Btuxcare.els8?arch=arm64&os_name=debian&os_version=13"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els5.arm64",
                "product": {
                  "name": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els5.arm64",
                  "product_id": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els5.arm64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/nginx1.27@1.27.5-1~trixie%2Btuxcare.els5?arch=arm64&os_name=debian&os_version=13"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els2.arm64",
                "product": {
                  "name": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els2.arm64",
                  "product_id": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els2.arm64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/nginx1.27@1.27.5-1~trixie%2Btuxcare.els2?arch=arm64&os_name=debian&os_version=13"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "TuxCare"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els10.amd64 as a component of Debian 13",
          "product_id": "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els10.amd64"
        },
        "product_reference": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els10.amd64",
        "relates_to_product_reference": "Debian-13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els10.arm64 as a component of Debian 13",
          "product_id": "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els10.arm64"
        },
        "product_reference": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els10.arm64",
        "relates_to_product_reference": "Debian-13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els8.arm64 as a component of Debian 13",
          "product_id": "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els8.arm64"
        },
        "product_reference": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els8.arm64",
        "relates_to_product_reference": "Debian-13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els8.amd64 as a component of Debian 13",
          "product_id": "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els8.amd64"
        },
        "product_reference": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els8.amd64",
        "relates_to_product_reference": "Debian-13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els5.amd64 as a component of Debian 13",
          "product_id": "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els5.amd64"
        },
        "product_reference": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els5.amd64",
        "relates_to_product_reference": "Debian-13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els5.arm64 as a component of Debian 13",
          "product_id": "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els5.arm64"
        },
        "product_reference": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els5.arm64",
        "relates_to_product_reference": "Debian-13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els2.amd64 as a component of Debian 13",
          "product_id": "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els2.amd64"
        },
        "product_reference": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els2.amd64",
        "relates_to_product_reference": "Debian-13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els2.arm64 as a component of Debian 13",
          "product_id": "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els2.arm64"
        },
        "product_reference": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els2.arm64",
        "relates_to_product_reference": "Debian-13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els1.amd64 as a component of Debian 13",
          "product_id": "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els1.amd64"
        },
        "product_reference": "nginx1.27-0:1.27.5-1~trixie+tuxcare.els1.amd64",
        "relates_to_product_reference": "Debian-13"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-53859",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "description",
          "text": "NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method \"none,\" and (3) the authentication server returns the \"Auth-Wait\" response header.\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
          "title": "Vulnerability description"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els10.amd64",
          "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els10.arm64"
        ],
        "known_affected": [
          "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els1.amd64",
          "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els2.amd64",
          "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els2.arm64",
          "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els5.amd64",
          "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els5.arm64",
          "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els8.amd64",
          "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els8.arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els-docker/cve/CVE-2025-53859"
        }
      ],
      "release_date": "2025-08-13T14:46:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-07T14:22:21.060585Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1783434137",
          "product_ids": [
            "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els10.amd64",
            "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els10.arm64"
          ],
          "url": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1783434137"
        },
        {
          "category": "none_available",
          "date": "2025-08-13T14:46:00Z",
          "details": "Affected",
          "product_ids": [
            "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els1.amd64",
            "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els2.amd64",
            "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els2.arm64",
            "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els5.amd64",
            "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els5.arm64",
            "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els8.amd64",
            "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els8.arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els10.amd64",
            "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els10.arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ]
    },
    {
      "cve": "CVE-2026-28755",
      "notes": [
        {
          "category": "description",
          "text": "\n",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els10.amd64",
          "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els10.arm64"
        ],
        "known_affected": [
          "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els1.amd64",
          "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els2.amd64",
          "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els2.arm64",
          "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els5.amd64",
          "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els5.arm64",
          "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els8.amd64",
          "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els8.arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els-docker/cve/CVE-2026-28755"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-07T14:22:21.060585Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1783434137",
          "product_ids": [
            "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els10.amd64",
            "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els10.arm64"
          ],
          "url": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1783434137"
        },
        {
          "category": "none_available",
          "details": "Affected",
          "product_ids": [
            "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els1.amd64",
            "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els2.amd64",
            "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els2.arm64",
            "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els5.amd64",
            "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els5.arm64",
            "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els8.amd64",
            "Debian-13:nginx1.27-0:1.27.5-1~trixie+tuxcare.els8.arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    }
  ]
}