This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2019-3890 →

DEBIAN-CVE-2019-3890

It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential i...

Original description

The description as published by the source.

It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 evolution-ews

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.5-1.1"}]}]

Debian:13 evolution-ews

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.5-1.1"}]}]

Debian:14 evolution-ews

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.5-1.1"}]}]

References

advisory security-tracker.debian.org