evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection."
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade evolution-data-server-docUpgrade evolution-develUpgrade evolution-data-server-testsUpgrade bogofilterUpgrade evolution-data-server-perl | May 4, 2022 | Jul 17, 2020 |
| Centos_linux | — | Upgrade evolution-langpacksUpgrade openchange-debuginfoUpgrade evolution-spamassassin-debuginfoUpgrade bogofilter-debugsourceUpgrade openchange-debugsourceUpgrade evolutionUpgrade evolution-data-server-langpacksUpgrade evolution-pst-debuginfoUpgrade evolution-pstUpgrade bogofilter-debuginfoUpgrade evolution-debuginfoUpgrade evolution-data-server-debuginfoUpgrade evolution-data-server-debugsourceUpgrade evolution-mapi-debuginfoUpgrade evolution-mapiUpgrade evolution-data-serverUpgrade evolution-data-server-tests-debuginfoUpgrade evolution-debugsourceUpgrade evolution-bogofilter-debuginfoUpgrade bogofilterUpgrade evolution-data-server-develUpgrade evolution-mapi-debugsourceUpgrade openchange-client-debuginfoUpgrade evolution-helpUpgrade evolution-bogofilterUpgrade openchangeUpgrade evolution-mapi-langpacksUpgrade evolution-spamassassin | Nov 5, 2020 | Jul 17, 2020 |
| Debian | — | Upgrade evolution-data-server | Jul 17, 2020 | Jul 17, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade evolution-data-server-develUpgrade evolution-data-server | Feb 22, 2021 | Jul 17, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade evolution-data-server-develUpgrade evolution-data-server | Apr 30, 2021 | Jul 17, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade evolution-data-server-develUpgrade evolution-data-server | Nov 2, 2020 | Jul 17, 2020 |
| Oracle Solaris | — | Upgrade library/desktop/evolution-data-server to version 3.34.0-11.4.27.0.1.82.0 on Solaris 11.4 | Jan 19, 2021 | Jul 17, 2020 |
| Oracle_linux | — | Upgrade evolution-develUpgrade evolutionUpgrade openchangeUpgrade evolution-data-server-testsUpgrade evolution-bogofilterUpgrade evolution-pstUpgrade evolution-mapi-langpacksUpgrade bogofilterUpgrade evolution-spamassassinUpgrade evolution-data-server-langpacksUpgrade evolution-langpacksUpgrade evolution-data-server-docUpgrade evolution-data-server-develUpgrade evolution-mapiUpgrade evolution-data-serverUpgrade evolution-helpUpgrade evolution-data-server-perl | Nov 12, 2020 | Jul 4, 2020 |
| Redhat_linux | — | No solution existsUpgrade bogofilterUpgrade evolution-data-server-docUpgrade evolution-mapi-debugsourceUpgrade evolution-data-serverUpgrade evolution-data-server-develUpgrade evolution-mapiUpgrade evolution-pstUpgrade openchangeUpgrade openchange-debugsourceUpgrade evolution-helpUpgrade evolution-data-server-tests-debuginfoUpgrade evolution-debuginfoUpgrade openchange-debuginfoUpgrade evolution-bogofilter-debuginfoUpgrade evolution-mapi-langpacksUpgrade evolution-data-server-perlUpgrade openchange-client-debuginfoUpgrade evolution-langpacksUpgrade evolution-pst-debuginfoUpgrade evolution-data-server-langpacksUpgrade bogofilter-debugsourceUpgrade evolution-mapi-debuginfoUpgrade evolution-spamassassinUpgrade evolution-data-server-debugsourceUpgrade evolutionUpgrade evolution-bogofilterUpgrade evolution-data-server-debuginfoUpgrade evolution-debugsourceUpgrade evolution-spamassassin-debuginfoUpgrade bogofilter-debuginfoUpgrade evolution-data-server-testsUpgrade evolution-devel | Nov 5, 2020 | Jul 17, 2020 |
| Rocky_linux | — | Upgrade evolution-mapi-debugsourceUpgrade bogofilterUpgrade evolution-mapiUpgrade evolution-mapi-debuginfoUpgrade bogofilter-debuginfoUpgrade bogofilter-debugsource | Mar 12, 2024 | Jul 17, 2020 |
| Suse | — | Upgrade typelib-1_0-EDataServerUI-1_2Upgrade libcamel-1_2-59Upgrade libebook-1_2-16Upgrade evolution-ewsUpgrade libedataserver-1_2-22Upgrade typelib-1_0-EDataServer-1_2Upgrade libcamel-1_2-59-32bitUpgrade libecal-2_0-1-32bitUpgrade libecal-2_0-1Upgrade libecal-1_2-19Upgrade typelib-1_0-Camel-1_2Upgrade libebackend-1_2-10Upgrade evolution-ews-langUpgrade libedataserver-1_2-24Upgrade libebook-contacts-1_2-2-32bitUpgrade libedata-cal-1_2-28-32bitUpgrade libedata-cal-2_0-1-32bitUpgrade libedata-book-1_2-26-32bitUpgrade libedataserverui-1_2-2-32bitUpgrade libebook-contacts-1_2-3-32bitUpgrade libedataserver-1_2-22-32bitUpgrade evolution-data-serverUpgrade libedata-cal-1_2-28Upgrade libebook-1_2-16-32bitUpgrade typelib-1_0-EBackend-1_2Upgrade libebook-1_2-20-32bitUpgrade typelib-1_0-EDataCal-2_0Upgrade typelib-1_0-EBookContacts-1_2Upgrade libedataserver-1_2-21Upgrade libedata-book-1_2-26Upgrade evolution-data-server-32bitUpgrade libebook-contacts-1_2-3Upgrade libcamel-1_2-62-32bitUpgrade evolution-data-server-develUpgrade libedata-book-1_2-25Upgrade libebook-1_2-20Upgrade libcamel-1_2-62Upgrade libedataserverui-1_2-2Upgrade libedataserverui-1_2-1Upgrade libcamel-1_2-57Upgrade libebook-contacts-1_2-2Upgrade typelib-1_0-ECal-2_0Upgrade libedataserver-1_2-24-32bitUpgrade libedata-cal-2_0-1Upgrade typelib-1_0-EBook-1_2Upgrade libecal-1_2-19-32bitUpgrade libedata-book-1_2-25-32bitUpgrade libebackend-1_2-10-32bitUpgrade evolution-data-server-langUpgrade typelib-1_0-EDataBook-1_2 | Mar 20, 2021 | Jul 17, 2020 |
| Ubuntu | — | Upgrade evolution-data-serverUpgrade libebackend-1.2-10Upgrade libedataserver-1.2-24Upgrade libcamel-1.2-62Upgrade libcamel-1.2-54Upgrade libedataserver-1.2-21Upgrade libcamel-1.2-61Upgrade evolution-data-server-commonUpgrade libedataserver-1.2-23 | Aug 5, 2020 | Jul 17, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub