PT-2019-16755 · Gnome+2 · Ses Evolution+2

Msiddiqu · Published 2019-02-15 · Updated 2020-04-08 · CVE-2019-3890

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions evolution-ews versions prior to 3.31.3

Description The issue allows an attacker to potentially obtain confidential information by tricking a user into connecting to a fake server, as the software does not properly validate SSL certificates.

Recommendations For versions prior to 3.31.3, update to version 3.31.3 or later to resolve the issue.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

CWE-296

Related Identifiers

CESA-2019_3699

CESA-2020_1080

CVE-2019-3890

RHSA-2019:3699

RHSA-2019_3699

RHSA-2020:1080

RHSA-2020_1080

Affected Products

Centos

Red Hat

Ses Evolution

References · 37

• https://linux.oracle.com/errata/ELSA-2019-3699.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-3890 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:3699 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-1080.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-3890 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-3890 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3890 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-3890 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-3890 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-3890 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15587 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-3890 · Security Note
• https://bdu.fstec.ru/vul/2019-02900 · Security Note
• https://access.redhat.com/errata/RHSA-2020:1080 · Note
• https://lists.centos.org/pipermail/centos-cr-announce/2020-April/025821.html · Note