It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1080 advisory.

    - Update patch for RH bug #1686408 (CVE-2018-15587: Reposition signature bar)
    - Add patch for RH bug #1686408 (CVE-2018-15587: Reposition signature bar)
    - Add patch related to evolution-ews CVE-2019-3890 (RH bug #1696762)

    evolution-ews

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-3699 advisory.

    - Add patch related to evolution-ews CVE-2019-3890 (RH bug #1696763)

    evolution-ews

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has atk packages installed that are affected by multiple vulnerabilities:

  - GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a     specially crafted email that contains a valid signature from the entity to be impersonated as an     attachment. (CVE-2018-15587)

  - It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker     could abuse this flaw to get confidential information by tricking the user into connecting to a fake     server without the user noticing the difference. (CVE-2019-3890)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3699 advisory.

  - evolution-ews: all certificate errors ignored if error is ignored during initial account setup in gnome-     online-accounts (CVE-2019-3890)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has evolution-data-server packages installed that are affected by a vulnerability:

  - It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker     could abuse this flaw to get confidential information by tricking the user into connecting to a fake     server without the user noticing the difference. (CVE-2019-3890)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has evolution-ews packages installed that are affected by a vulnerability:

  - It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker     could abuse this flaw to get confidential information by tricking the user into connecting to a fake     server without the user noticing the difference. (CVE-2019-3890)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has evolution-ews packages installed that are affected by a vulnerability:

  - It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker     could abuse this flaw to get confidential information by tricking the user into connecting to a fake     server without the user noticing the difference. (CVE-2019-3890)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has evolution-data-server packages installed that are affected by a vulnerability:

  - It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker     could abuse this flaw to get confidential information by tricking the user into connecting to a fake     server without the user noticing the difference. (CVE-2019-3890)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of evolution-data-server installed on the remote host is prior to 3.28.5-4. The version of evolution-ews installed on the remote host is prior to 3.28.5-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1475 advisory.

    It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker     could abuse this flaw to get confidential information by tricking the user into connecting to a fake     server without the user noticing the difference. (CVE-2019-3890)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

* evolution: specially crafted email leading to OpenPGP signatures being spoofed for arbitrary messages * evolution-ews: all certificate errors ignored if error is ignored during initial account setup in gnome-online-accounts

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1080 advisory.

  - GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a     specially crafted email that contains a valid signature from the entity to be impersonated as an     attachment. (CVE-2018-15587)

  - It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker     could abuse this flaw to get confidential information by tricking the user into connecting to a fake     server without the user noticing the difference. (CVE-2019-3890)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1080 advisory.

    Evolution is a GNOME application that provides integrated email, calendar, contact management, and     communications functionality.

    The evolution-data-server packages provide a unified back end for applications which interact with     contacts, tasks and calendar information. Evolution Data Server was originally developed as a back end for     the Evolution information management application, but is now used by various other applications.

    Security Fix(es):

    * evolution: specially crafted email leading to OpenPGP signatures being spoofed for arbitrary messages     (CVE-2018-15587)

    * evolution-ews: all certificate errors ignored if error is ignored during initial account setup in gnome-     online-accounts (CVE-2019-3890)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3699 advisory.

    Evolution is a GNOME application that provides integrated email, calendar, contact management, and     communications functionality.

    Security Fix(es):

    * evolution-ews: all certificate errors ignored if configured to ignore an initial error in gnome-online-     accounts creation resulting in the connection open to being viewed and modified. (CVE-2019-3890)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix for CVE-2019-3890 - SSL Certificates are not validated

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
180723	Oracle Linux 7 : evolution (ELSA-2020-1080)	Nessus	Oracle Linux Local Security Checks	high
180673	Oracle Linux 8 : evolution (ELSA-2019-3699)	Nessus	Oracle Linux Local Security Checks	high
174092	NewStart CGSL CORE 5.05 / MAIN 5.05 : atk Multiple Vulnerabilities (NS-SA-2023-0013)	Nessus	NewStart CGSL Local Security Checks	high
164612	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.17.1)	Nessus	Misc.	critical
164596	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.15.3)	Nessus	Misc.	high
164595	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.18)	Nessus	Misc.	critical
145600	CentOS 8 : evolution (CESA-2019:3699)	Nessus	CentOS Local Security Checks	high
143903	NewStart CGSL CORE 5.05 / MAIN 5.05 : evolution-data-server Vulnerability (NS-SA-2020-0114)	Nessus	NewStart CGSL Local Security Checks	high
143901	NewStart CGSL CORE 5.05 / MAIN 5.05 : evolution-ews Vulnerability (NS-SA-2020-0086)	Nessus	NewStart CGSL Local Security Checks	high
143895	NewStart CGSL CORE 5.04 / MAIN 5.04 : evolution-ews Vulnerability (NS-SA-2020-0056)	Nessus	NewStart CGSL Local Security Checks	high
143892	NewStart CGSL CORE 5.04 / MAIN 5.04 : evolution-data-server Vulnerability (NS-SA-2020-0075)	Nessus	NewStart CGSL Local Security Checks	high
139862	Amazon Linux 2 : evolution-data-server, evolution-ews (ALAS-2020-1475)	Nessus	Amazon Linux Local Security Checks	high
135807	Scientific Linux Security Update : evolution on SL7.x x86_64 (20200407)	Nessus	Scientific Linux Local Security Checks	high
135332	CentOS 7 : evolution (RHSA-2020:1080)	Nessus	CentOS Local Security Checks	high
135047	RHEL 7 : evolution (RHSA-2020:1080)	Nessus	Red Hat Local Security Checks	high
130566	RHEL 8 : evolution (RHSA-2019:3699)	Nessus	Red Hat Local Security Checks	high
123803	Fedora 29 : evolution-data-server / evolution-ews (2019-3a2cc6a0b9)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2019-3890

high

Tenable Plugins

high

high

high

critical

high

critical

high

high

high

high

high

high

high

high

high

high

high