GNOME Geary before 3.36.3 mishandles pinned TLS certificate verification for IMAP and SMTP services using invalid TLS certificates (e.g., self-signed certificates) when the client system is not configured to use a system-provided PKCS#11 store. This allows a meddler in the middle to present a different invalid certificate to intercept incoming and outgoing mail.
References
Configurations
History
07 Nov 2023, 03:20
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
22 Feb 2022, 10:04
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* |
|
First Time |
Fedoraproject fedora
Fedoraproject |
|
References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NS6CSTOBVO5HSAR3X5CT6DS6QDHXDB26/ - Mailing List, Third Party Advisory | |
References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G7OTYTGND6EFOKNQJWCHKKXKSN7SM73Y/ - Mailing List, Third Party Advisory | |
References | (CISCO) https://tools.cisco.com/security/center/content/CiscoSeg/message/NS6CSTOBVO5HSAR3X5CT6DS6QDHXDB26/ - Broken Link |
16 Feb 2022, 15:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
Information
Published : 2020-08-26 16:15
Updated : 2023-12-10 13:27
NVD link : CVE-2020-24661
Mitre link : CVE-2020-24661
CVE.ORG link : CVE-2020-24661
JSON object : View
Products Affected
fedoraproject
- fedora
gnome
- geary
CWE
CWE-295
Improper Certificate Validation