PT-2019-16755 · Gnome+2 · Ses Evolution+2

Msiddiqu · Publicado 2019-02-15 · Atualizado 2020-04-08 · CVE-2019-3890

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions evolution-ews versions prior to 3.31.3

Description The issue allows an attacker to potentially obtain confidential information by tricking a user into connecting to a fake server, as the software does not properly validate SSL certificates.

Recommendations For versions prior to 3.31.3, update to version 3.31.3 or later to resolve the issue.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

CWE-296

Identificadores relacionados

CESA-2019_3699

CESA-2020_1080

CVE-2019-3890

RHSA-2019:3699

RHSA-2019_3699

RHSA-2020:1080

RHSA-2020_1080

Produtos afetados

Centos

Red Hat

Ses Evolution

Referências · 37

• https://access.redhat.com/errata/RHSA-2020:1080 · Nota
• https://lists.centos.org/pipermail/centos-cr-announce/2020-April/025821.html · Nota
• https://linux.oracle.com/errata/ELSA-2019-3699.html · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-3890 · Aviso do Fabricante
• https://lists.centos.org/pipermail/centos-cr-announce/2020-April/032478.html · Nota
• https://bugzilla.gnome.org/show_bug.cgi?id=796424 · Nota
• https://access.redhat.com/errata/RHSA-2019:3699 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2018-15587 · Nota
• https://lists.centos.org/pipermail/centos-cr-announce/2020-April/032512.html · Nota
• https://lists.centos.org/pipermail/centos-cr-announce/2020-April/012443.html · Nota
• https://linux.oracle.com/errata/ELSA-2020-1080.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-3890 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3890 · Nota
• https://ubuntu.com/security/CVE-2019-3890 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3890 · Nota de Segurança