- Vulnerability/
- USN-4429-1
22/7/2020
USN-4429-1: Evolution Data Server vulnerability
First published: Wed Jul 22 2020(Updated: )
It was discovered that Evolution Data Server incorrectly handled STARTTLS when using SMTP and POP3. A remote attacker could possibly use this issue to perform a response injection attack.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/evolution-data-server | <3.36.3-0ubuntu1.1 | 3.36.3-0ubuntu1.1 |
| =20.04 | ||
| All of | ||
| ubuntu/evolution-data-server-common | <3.36.3-0ubuntu1.1 | 3.36.3-0ubuntu1.1 |
| =20.04 | ||
| All of | ||
| ubuntu/libcamel-1.2-62 | <3.36.3-0ubuntu1.1 | 3.36.3-0ubuntu1.1 |
| =20.04 | ||
| All of | ||
| ubuntu/libebackend-1.2-10 | <3.36.3-0ubuntu1.1 | 3.36.3-0ubuntu1.1 |
| =20.04 | ||
| All of | ||
| ubuntu/libedataserver-1.2-24 | <3.36.3-0ubuntu1.1 | 3.36.3-0ubuntu1.1 |
| =20.04 | ||
| All of | ||
| ubuntu/evolution-data-server | <3.28.5-0ubuntu0.18.04.3 | 3.28.5-0ubuntu0.18.04.3 |
| =18.04 | ||
| All of | ||
| ubuntu/evolution-data-server-common | <3.28.5-0ubuntu0.18.04.3 | 3.28.5-0ubuntu0.18.04.3 |
| =18.04 | ||
| All of | ||
| ubuntu/libcamel-1.2-61 | <3.28.5-0ubuntu0.18.04.3 | 3.28.5-0ubuntu0.18.04.3 |
| =18.04 | ||
| All of | ||
| ubuntu/libebackend-1.2-10 | <3.28.5-0ubuntu0.18.04.3 | 3.28.5-0ubuntu0.18.04.3 |
| =18.04 | ||
| All of | ||
| ubuntu/libedataserver-1.2-23 | <3.28.5-0ubuntu0.18.04.3 | 3.28.5-0ubuntu0.18.04.3 |
| =18.04 | ||
| All of | ||
| ubuntu/evolution-data-server | <3.18.5-1ubuntu1.3 | 3.18.5-1ubuntu1.3 |
| =16.04 | ||
| All of | ||
| ubuntu/evolution-data-server-common | <3.18.5-1ubuntu1.3 | 3.18.5-1ubuntu1.3 |
| =16.04 | ||
| All of | ||
| ubuntu/libcamel-1.2-54 | <3.18.5-1ubuntu1.3 | 3.18.5-1ubuntu1.3 |
| =16.04 | ||
| All of | ||
| ubuntu/libebackend-1.2-10 | <3.18.5-1ubuntu1.3 | 3.18.5-1ubuntu1.3 |
| =16.04 | ||
| All of | ||
| ubuntu/libedataserver-1.2-21 | <3.18.5-1ubuntu1.3 | 3.18.5-1ubuntu1.3 |
| =16.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://ubuntu.com/security/CVE-2020-14928
- https://launchpad.net/ubuntu/+source/evolution-data-server/3.36.3-0ubuntu1.1
- https://launchpad.net/ubuntu/+source/evolution-data-server/3.28.5-0ubuntu0.18.04.3
- https://launchpad.net/ubuntu/+source/evolution-data-server/3.18.5-1ubuntu1.3
- https://ubuntu.com/security/notices/USN-4429-1 (Advisory)
Frequently Asked Questions
What is the vulnerability ID?
USN-4429-1
What software is affected by this vulnerability?
Evolution Data Server
How does the vulnerability occur?
Evolution Data Server incorrectly handles STARTTLS when using SMTP and POP3.
What is the potential impact of this vulnerability?
A remote attacker could use this vulnerability to perform a response injection attack.
How do I fix this vulnerability?
Install the latest version of Evolution Data Server.
- agent/type
- agent/severity
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- agent/title
- agent/references
- agent/description
- agent/tags
- agent/event
- collector/usn
- source/Ubuntu
- agent/software-canonical-lookup
- agent/trending
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu ubuntu
- version/ubuntu ubuntu/20.04
- version/ubuntu ubuntu/18.04
- version/ubuntu ubuntu/16.04