PT-2020-7479 · Gnome+3 · Evolution Data Server+4

Published 2013-08-11 · Updated 2023-02-13 · CVE-2013-4166

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: GNOME Evolution versions 3.8.4 and earlier Evolution Data Server versions 3.9.5 and earlier

Description: The issue is related to the gpg ctx add recipient function, which does not properly select the GPG key for email encryption. This might cause emails to be encrypted with the wrong key, potentially allowing remote attackers to obtain sensitive information.

Recommendations: For GNOME Evolution versions 3.8.4 and earlier, update to a version later than 3.8.4 to resolve the issue. For Evolution Data Server versions 3.9.5 and earlier, update to a version later than 3.9.5 to resolve the issue. As a temporary workaround, consider restricting the use of email encryption until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CESA-2013_1540

CVE-2013-4166

MGASA-2013-0245

RHSA-2013:1540

RHSA-2013_1540

Affected Products

Centos

Debian

Evolution Data Server

Gnome Evolution

Red Hat

References · 15

• https://advisories.mageia.org/MGASA-2013-0245.html · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4166 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4166 · Security Note
• https://osv.dev/vulnerability/MGASA-2013-0245 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-4166 · Vendor Advisory
• https://git.gnome.org/browse/evolution-data-server/commit/?h=gnome-3-8&id=f7059bb37dcce485d36d769142ec9515708d8ae5 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2013-1540.html · Vendor Advisory
• https://git.gnome.org/browse/evolution-data-server/commit/?id=5d8b92c622f6927b253762ff9310479dd3ac627d · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-4166 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=973728 · Note
• http://ubuntu.com/usn/usn-1922-1 · Note
• https://t.me/cvenotify/833 · Telegram Post
• http://rhn.redhat.com/errata/RHSA-2013-1540.html · Note
• http://seclists.org/oss-sec/2013/q3/191 · Note
• https://bugs.mageia.org/show_bug.cgi?id=10896 · Note