CVE-2021-3349

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-3349
GNOME Evolution through 3.38.3 produces a "Valid signature" message for an unknown identifier on a previously trusted key because Evolution does not retrieve enough information from the GnuPG API. NOTE: third parties dispute the significance of this issue, and dispute whether Evolution is the best place to change this behavior

3.3 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

2.1 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://dev.gnupg.org/T4735 Third Party Advisory
https://gitlab.gnome.org/GNOME/evolution/-/issues/299 Third Party Advisory
https://mgorny.pl/articles/evolution-uid-trust-extrapolation.html Exploit Technical Description Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:gnome:evolution:*:*:*:*:*:*:*:*
History

07 Nov 2023, 03:37

Type Values Removed Values Added
Summary ** DISPUTED ** GNOME Evolution through 3.38.3 produces a "Valid signature" message for an unknown identifier on a previously trusted key because Evolution does not retrieve enough information from the GnuPG API. NOTE: third parties dispute the significance of this issue, and dispute whether Evolution is the best place to change this behavior. GNOME Evolution through 3.38.3 produces a "Valid signature" message for an unknown identifier on a previously trusted key because Evolution does not retrieve enough information from the GnuPG API. NOTE: third parties dispute the significance of this issue, and dispute whether Evolution is the best place to change this behavior

08 Feb 2021, 21:11

Type Values Removed Values Added
CPE cpe:2.3:a:gnome:evolution:*:*:*:*:*:*:*:*
CWE CWE-345
CVSS v2 : unknown
v3 : unknown 		v2 : 2.1
v3 : 3.3
References (MISC) https://dev.gnupg.org/T4735 - (MISC) https://dev.gnupg.org/T4735 - Third Party Advisory
References (MISC) https://gitlab.gnome.org/GNOME/evolution/-/issues/299 - (MISC) https://gitlab.gnome.org/GNOME/evolution/-/issues/299 - Third Party Advisory
References (MISC) https://mgorny.pl/articles/evolution-uid-trust-extrapolation.html - (MISC) https://mgorny.pl/articles/evolution-uid-trust-extrapolation.html - Exploit, Technical Description, Third Party Advisory

01 Feb 2021, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2021-02-01 05:15

Updated : 2024-04-11 01:12

NVD link : CVE-2021-3349

Mitre link : CVE-2021-3349

CVE.ORG link : CVE-2021-3349

JSON object : View

Products Affected

gnome

  • evolution
CWE
CWE-345

Insufficient Verification of Data Authenticity