Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-3890: It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference. 1678313: CVE-2019-3890 evolution-ews: all certificate errors ignored if error is ignored during initial account setup in gnome-online-accounts
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | evolution-data-server | 0:3.28.5-4.amzn2.0.1 |
| Amazon Linux · 2 | evolution-data-server-debuginfo | 0:3.28.5-4.amzn2.0.1 |
| Amazon Linux · 2 | evolution-data-server-devel | 0:3.28.5-4.amzn2.0.1 |
| Amazon Linux · 2 | evolution-data-server-doc | 0:3.28.5-4.amzn2.0.1 |
| Amazon Linux · 2 | evolution-data-server-langpacks | 0:3.28.5-4.amzn2.0.1 |
| Amazon Linux · 2 | evolution-data-server-perl | 0:3.28.5-4.amzn2.0.1 |
| Amazon Linux · 2 | evolution-data-server-tests | 0:3.28.5-4.amzn2.0.1 |
| Amazon Linux · 2 | evolution-ews | 0:3.28.5-5.amzn2 |
| Amazon Linux · 2 | evolution-ews-debuginfo | 0:3.28.5-5.amzn2 |
| Amazon Linux · 2 | evolution-ews-langpacks | 0:3.28.5-5.amzn2 |
Vulnerabilities 1
-
High 8.1
It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-3890.html