CVE-2020-14928

Опубликовано: 17 июл. 2020

Источник: nvd

CVSS3: 5.9

CVSS2: 4.3

EPSS Низкий

Описание

evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection."

Ссылки

https://bugzilla.suse.com/show_bug.cgi?id=1173910
Issue Tracking
Patch
Third Party Advisory
https://gitlab.gnome.org/GNOME//evolution-data-server/commit/ba82be72cfd427b5d72ff21f929b3a6d8529c4df
Patch
Third Party Advisory
https://gitlab.gnome.org/GNOME/evolution-data-server/-/commit/f404f33fb01b23903c2bbb16791c7907e457fbac
Patch
Third Party Advisory
https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/226
Exploit
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/07/msg00012.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMBEZWA22EAYAZQWUX4KPEBER726KSIG/
https://security-tracker.debian.org/tracker/DLA-2281-1
Third Party Advisory
https://security-tracker.debian.org/tracker/DSA-4725-1
Third Party Advisory
https://usn.ubuntu.com/4429-1/
Third Party Advisory
https://www.debian.org/security/2020/dsa-4725
Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1173910
Issue Tracking
Patch
Third Party Advisory
https://gitlab.gnome.org/GNOME//evolution-data-server/commit/ba82be72cfd427b5d72ff21f929b3a6d8529c4df
Patch
Third Party Advisory
https://gitlab.gnome.org/GNOME/evolution-data-server/-/commit/f404f33fb01b23903c2bbb16791c7907e457fbac
Patch
Third Party Advisory
https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/226
Exploit
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/07/msg00012.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMBEZWA22EAYAZQWUX4KPEBER726KSIG/
https://security-tracker.debian.org/tracker/DLA-2281-1
Third Party Advisory
https://security-tracker.debian.org/tracker/DSA-4725-1
Third Party Advisory
https://usn.ubuntu.com/4429-1/
Third Party Advisory
https://www.debian.org/security/2020/dsa-4725
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:gnome:evolution-data-server:*:*:*:*:*:*:*:*

Версия до 3.36.3 (включая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

EPSS

Процентиль: 88%

0.04044

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-74

Связанные уязвимости

CVE-2020-14928

CVSS3: 5.9

ubuntu

почти 5 лет назад

CVE-2020-14928

CVSS3: 5.3

redhat

почти 5 лет назад

CVE-2020-14928

CVSS3: 5.9

debian

почти 5 лет назад

evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering is ...

RLSA-2020:4649

rocky

больше 4 лет назад

Low: evolution security and bug fix update

GHSA-3rg7-72j5-5xpv

github

около 3 лет назад

EPSS

Процентиль: 88%

0.04044

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-74