Summary
Jon Kristensen discovered that Evolution Data Server would automatically
downgrade a connection to an IMAP server if the IMAP server did not support
SSL. This would result in the user's password being unexpectedly sent in clear
text, even though the user had requested to use SSL.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | evolution-data-server | 3.10.4-0ubuntu1.6 |
| Ubuntu · 16.04 LTS 16.04:LTS | evolution-data-server | 3.18.5-1ubuntu1.1 |
Vulnerabilities 1
-
Unscored —
camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds…
References
-
report
https://ubuntu.com/security/CVE-2016-10727