Description
It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The Gnome Project | evolution-ews | 3.31.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | evolution-ews | 3.30.5-1.1 | — |
| Debian 13 | evolution-ews | 3.30.5-1.1 | — |
| Debian 12 | evolution-ews | 3.30.5-1.1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | evolution-ews | No fix yet | — |
| Ubuntu 26.04 LTS | evolution-ews | No fix yet | — |
| Ubuntu 25.10 | evolution-ews | No fix yet | — |
| Ubuntu 24.04 LTS | evolution-ews | No fix yet | — |
| Ubuntu 22.04 LTS | evolution-ews | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | evolution-ews | No fix yet | — |
| Ubuntu 18.04 LTS | evolution-ews | No fix yet | — |
| Ubuntu 16.04 LTS | evolution-ews | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | evolution +6 | 3.28.5-9.el8 | RHSA-2019:3699 |
| RHEL 8 | evolution-data-server +5 | 3.28.5-11.el8 | RHSA-2019:3699 |
| RHEL 8 | evolution-ews +1 | 3.28.5-5.el8 | RHSA-2019:3699 |
| RHEL 7 | atk +1 | 2.28.1-2.el7 | RHSA-2020:1080 |
| RHEL 7 | evolution +7 | 3.28.5-8.el7 | RHSA-2020:1080 |
| RHEL 7 | evolution-data-server +5 | 3.28.5-4.el7 | RHSA-2020:1080 |
| RHEL 7 | evolution-ews +1 | 3.28.5-5.el7 | RHSA-2020:1080 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | evolution-data-server +5 | 3.28.5-4.amzn2.0.1 | ALAS2-2020-1475 |
| Amazon Linux 2 | evolution-ews +1 | 3.28.5-5.amzn2 | ALAS2-2020-1475 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | evolution +6 | 3.28.5-9.el8 | ELSA-2019-3699 |
| Oracle Linux 8 | evolution-data-server +5 | 3.28.5-11.el8 | ELSA-2019-3699 |
| Oracle Linux 8 | evolution-ews +1 | 3.28.5-5.el8 | ELSA-2019-3699 |
| Oracle Linux 7 | atk +1 | 2.28.1-2.el7 | ELSA-2020-1080 |
| Oracle Linux 7 | evolution +7 | 3.28.5-8.el7 | ELSA-2020-1080 |
| Oracle Linux 7 | evolution-data-server +5 | 3.28.5-4.el7 | ELSA-2020-1080 |
| Oracle Linux 7 | evolution-ews +1 | 3.28.5-5.el7 | ELSA-2020-1080 |
Advisories 5
- RHSA-2020:1080 Red Hat Security Advisory: evolution security and bug fix update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2019:3699 Red Hat Security Advisory: evolution security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- ALAS2-2020-1475 Moderate: evolution-data-server security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 25, 2020
- ELSA-2020-1080 Moderate: evolution security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Apr 6, 2020
- ELSA-2019-3699 Moderate: evolution security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 14, 2019