Vulnerability · Published Feb 1, 2021 · Assigned by mitre
CVE-2021-3349
Low 3.3
In plain English
A low-severity security flaw in the evolution package (Debian). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Severity (CVSS NVD)3.3Low
Exploit odds (30 days)0.4%top 71.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
GNOME Evolution through 3.38.3 produces a "Valid signature" message for an unknown identifier on a previously trusted key because Evolution does not retrieve enough information from the GnuPG API. NOTE: third parties dispute the significance of this issue, and dispute whether Evolution is the best place to change this behavior
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | evolution | no fix listed | DEBIAN-CVE-2021-3349 |
| Debian:13 | evolution | no fix listed | DEBIAN-CVE-2021-3349 |
| Debian:14 | evolution | no fix listed | DEBIAN-CVE-2021-3349 |
Affected products (as reported)
References
- https://gitlab.gnome.org/GNOME/evolution/-/issues/299 x_refsource_MISC
- https://mgorny.pl/articles/evolution-uid-trust-extrapolation.html x_refsource_MISC
- https://dev.gnupg.org/T4735 x_refsource_MISC