Vulnerability · Published Aug 26, 2020 · Assigned by mitre
CVE-2020-24661
Medium 5.9
In plain English
A medium-severity security flaw in the geary package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.9Medium
Exploit odds (30 days)0.9%top 39.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
GNOME Geary before 3.36.3 mishandles pinned TLS certificate verification for IMAP and SMTP services using invalid TLS certificates (e.g., self-signed certificates) when the client system is not configured to use a system-provided PKCS#11 store. This allows a meddler in the middle to present a different invalid certificate to intercept incoming and outgoing mail.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | geary | 3.37.91-r0 | ALPINE-CVE-2020-24661 |
| Alpine:v3.21 | geary | 3.37.91-r0 | ALPINE-CVE-2020-24661 |
| Alpine:v3.22 | geary | 3.37.91-r0 | ALPINE-CVE-2020-24661 |
| Alpine:v3.23 | geary | 3.37.91-r0 | ALPINE-CVE-2020-24661 |
| Alpine:v3.24 | geary | 3.37.91-r0 | ALPINE-CVE-2020-24661 |
| Debian:12 | geary | 3.38.0.1-1 | DEBIAN-CVE-2020-24661 |
| Debian:13 | geary | 3.38.0.1-1 | DEBIAN-CVE-2020-24661 |
| Debian:14 | geary | 3.38.0.1-1 | DEBIAN-CVE-2020-24661 |
Affected products (as reported)
References
- https://gitlab.gnome.org/GNOME/geary/-/issues/866 x_refsource_MISC
- FEDORA-2020-d445fb484a vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-95f2c5cc25 vendor-advisory, x_refsource_FEDORA
- 20200902 Cisco Jabber for Windows Information Disclosure Vulnerability vendor-advisory, x_refsource_CISCO