Description
The camel component for Ximian Evolution 1.0.x and earlier does not verify certificates when it establishes a new SSL connection after previously verifying a certificate, which could allow remote attackers to monitor or modify sessions via a man-in-the-middle attack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | evolution | 1.2.0-1 | — |
| Debian 13 | evolution | 1.2.0-1 | — |
| Debian 12 | evolution | 1.2.0-1 | — |
References
- evolution-camel-certificate-mitm(10292) vdb-entry
- 20021003 SSL certificate validation problems in Ximian Evolution mailing-list
- 5875 vdb-entry