camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data containing a password if the client wishes to use STARTTLS but the server will not use STARTTLS, which makes it easier for remote attackers to obtain sensitive information by sniffing the network. The server code was intended to report an error and not proceed, but the code was written incorrectly.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade evolution-data-server | Feb 20, 2019 | Jul 20, 2018 |
| Ubuntu | — | Upgrade libedataserver-1.2-18Upgrade evolution-data-server-commonUpgrade libedataserver-1.2-21Upgrade evolution-data-serverUpgrade libebackend-1.2-7Upgrade libcamel-1.2-45Upgrade libcamel-1.2-54Upgrade libebackend-1.2-10 | Aug 7, 2018 | Jul 20, 2018 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub