NetSight
IP …
medium5.9

CVE-2020-14928

evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3.

Impact

evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection."

Affected products

VendorProductAffected versions
GnomeEvolution-Data-Server
through 3.36.3
DebianDebian Linux
Versions 9.0, 10.0
FedoraprojectFedora
Version 31
CanonicalUbuntu Linux
Versions 16.04, 18.04, 20.04

Weakness classification

CWE-74

References