Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Red Hat: RHSA-2020-4649-01 Low: Evolution Response Injection in SMTP

red hat
Calendar Grey November 4, 2020
Dist Redhat Esm H88
Investigate the most recent Red Hat notice regarding evolution security, featuring minimal impact upgrades and solutions for various issues.
An update for bogofilter, evolution, evolution-data-server, evolution-mapi, and openchange is now available for Red Hat Enterprise Linux 8

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Evolution must be restarted for this update to take effect.

Summary

Evolution is a GNOME application that provides integrated email, calendar, contact management, and communications functionality.
The evolution-data-server packages provide a unified back end for applications which interact with contacts, tasks and calendar information. Evolution Data Server was originally developed as a back end for the Evolution information management application, but is now used by various other applications.
OpenChange provides libraries to access Microsoft Exchange servers using native protocols.
Security Fix(es):
* evolution-data-server: Response injection via STARTTLS in SMTP and POP3 (CVE-2020-14928)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.

Topics%20covered

Topics Covered

security advisory Red Hat bug fix evolution email client SMTP response injection

References

https://access.redhat.com/security/cve/CVE-2020-14928 https://access.redhat.com/security/updates/classification/#low https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/

Package List

Red Hat Enterprise Linux AppStream (v. 8):
Source: bogofilter-1.2.5-2.el8.src.rpm evolution-3.28.5-14.el8.src.rpm evolution-data-server-3.28.5-14.el8.src.rpm evolution-mapi-3.28.3-3.el8.src.rpm openchange-2.3-26.el8.src.rpm
aarch64: bogofilter-1.2.5-2.el8.aarch64.rpm bogofilter-debuginfo-1.2.5-2.el8.aarch64.rpm bogofilter-debugsource-1.2.5-2.el8.aarch64.rpm evolution-3.28.5-14.el8.aarch64.rpm evolution-bogofilter-3.28.5-14.el8.aarch64.rpm evolution-bogofilter-debuginfo-3.28.5-14.el8.aarch64.rpm evolution-data-server-3.28.5-14.el8.aarch64.rpm evolution-data-server-debuginfo-3.28.5-14.el8.aarch64.rpm evolution-data-server-debugsource-3.28.5-14.el8.aarch64.rpm evolution-data-server-devel-3.28.5-14.el8.aarch64.rpm evolution-data-server-tests-debuginfo-3.28.5-14.el8.aarch64.rpm evolution-debuginfo-3.28.5-14.el8.aarch64.rpm evolution-debugsource-3.28.5-14.el8.aarch64.rpm evolution-mapi-3.28.3-3.el8.aarch64.rpm evolution-mapi-debuginfo-3.28.3-3.el8.aarch64.rpm evolution-mapi-debugsource-3.28.3-3.el8.aarch64.rpm evolution-pst-3.28.5-14.el8.aarch64.rpm evolution-pst-debuginfo-3.28.5-14.el8.aarch64.rpm evolution-spamassassin-3.28.5-14.el8.aarch64.rpm evolution-spamassassin-debuginfo-3.28.5-14.el8.aarch64.rpm openchange-2.3-26.el8.aarch64.rpm

Read the Full Advisory


Severity
low
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2020:4649-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:4649
Issue date: 2020-11-03

Topic

An update for bogofilter, evolution, evolution-data-server, evolution-mapi,and openchange is now available for Red Hat Enterprise Linux 8.Red Hat Product Security has rated this update as having a security impactof Low. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory Red Hat bug fix evolution email client SMTP response injection

Relevant Releases Architectures

Red Hat CodeReady Linux Builder (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64

Bugs Fixed

1825447 - openchange: does not rebuild with samba-4.11.2-7.el8

1836165 - Cannot type the date of a meeting

1836279 - Please upgrade to bogofilter 1.2.5

1857470 - CVE-2020-14928 evolution-data-server: Response injection via STARTTLS in SMTP and POP3

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here