Lucene search

K
centosCentOS ProjectCESA-2020:1080
HistoryApr 08, 2020 - 5:42 p.m.

atk, evolution security update

2020-04-0817:42:28
CentOS Project
lists.centos.org
114

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS

0.003

Percentile

69.9%

CentOS Errata and Security Advisory CESA-2020:1080

Evolution is a GNOME application that provides integrated email, calendar, contact management, and communications functionality.

The evolution-data-server packages provide a unified back end for applications which interact with contacts, tasks and calendar information. Evolution Data Server was originally developed as a back end for the Evolution information management application, but is now used by various other applications.

Security Fix(es):

  • evolution: specially crafted email leading to OpenPGP signatures being spoofed for arbitrary messages (CVE-2018-15587)

  • evolution-ews: all certificate errors ignored if error is ignored during initial account setup in gnome-online-accounts (CVE-2019-3890)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.8 Release Notes linked from the References section.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-cr-announce/2020-April/032478.html
https://lists.centos.org/pipermail/centos-cr-announce/2020-April/032511.html
https://lists.centos.org/pipermail/centos-cr-announce/2020-April/032512.html
https://lists.centos.org/pipermail/centos-cr-announce/2020-April/032513.html

Affected packages:
atk
atk-devel
evolution
evolution-bogofilter
evolution-data-server
evolution-data-server-devel
evolution-data-server-doc
evolution-data-server-langpacks
evolution-data-server-perl
evolution-data-server-tests
evolution-devel
evolution-devel-docs
evolution-ews
evolution-ews-langpacks
evolution-help
evolution-langpacks
evolution-pst
evolution-spamassassin

Upstream details at:
https://access.redhat.com/errata/RHSA-2020:1080

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS

0.003

Percentile

69.9%