Stay Secure with the Latest Linux Advisories

security advisoryMageiaresponse injection

Mageia: 2020-0351 Security Update: evolution-data-server STARTTLS Risk

evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection". (CVE-2020-14928) . MGASA-2020-0351 - Updated evolution-data-server packages fix security vulnerabilities Publication date: 28 Aug 2020 URL: https://advisories.mageia.org/MGASA-2020-0351.html Type: security Affected Mageia releases: 7 CVE: CVE-2020-14928, CVE-2020-16117 evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection". (CVE-2020-14928) In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an invalid (e.g., minimal) CAPABILITY line on a connection attempt. This is related to imapx_free_capability and imapx_connect_to_server. (CVE-2020-16117) References: - https://bugs.mageia.org/show_bug.cgi?id=26962 - https://lists.debian.org/debian-security-announce/2020/msg00131.html - https://lists.debian.org/debian-security-announce/2020/msg00131.html - https://lists.debian.org/debian-lts-announce/2020/07/msg00012.html - https://lists.debian.org/debian-lts-announce/2020/08/msg00005.html - https://www.cve.org/CVERecord?id=CVE-2020-14928 - https://www.cve.org/CVERecord?id=CVE-2020-16117 SRPMS: - 7/core/evolution-data-server-3.32.2-1.2.mga7 . Revised evolution-data-server components address significant challenges impacting SMTP and POP3 linkages within Mageia.. evolution-data-server, security update, Mageia advisory, STARTTLS issue. . Severity: Critical. LinuxSecurity.com Team

Aug 28, 2020 •Critical Mageia