CVE-2020-14928

MEDIUM 5.9CVE-2020-14928 · Published 17/07/2020 · updated 17/06/2026

In short

CVE-2020-14928 is a MEDIUM (CVSS 5.9) vulnerability affecting evolution-data-server (gnome).
Chance of exploitation in the next 30 days (EPSS): 2.8%, higher than 86.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
evolution-data-server gnome	`≤ 3.36.3`	No fix yet

Description

evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection."

References

bugzilla.suse.com/show_bug.cgi · Issue Tracking
gitlab.gnome.org/GNOME//evolution-data-server/commit/ba82be72cfd427b5d72ff21f929b3a6d8529c4df · Patch
gitlab.gnome.org/GNOME/evolution-data-server/-/commit/f404f33fb01b23903c2bbb16791c7907e457fbac · Patch
gitlab.gnome.org/GNOME/evolution-data-server/-/issues/226 · Exploit
lists.debian.org/debian-lts-announce/2020/07/msg00012.html · Mailing List
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMBEZWA22EAYAZQWUX4KPEBER726KSIG
security-tracker.debian.org/tracker/DLA-2281-1 · Third Party Advisory
security-tracker.debian.org/tracker/DSA-4725-1 · Third Party Advisory
usn.ubuntu.com/4429-1 · Third Party Advisory
debian.org/security/2020/dsa-4725

More vulnerabilities in evolution-data-server

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free