Description
GNOME Geary before 3.36.3 mishandles pinned TLS certificate verification for IMAP and SMTP services using invalid TLS certificates (e.g., self-signed certificates) when the client system is not configured to use a system-provided PKCS#11 store. This allows a meddler in the middle to present a different invalid certificate to intercept incoming and outgoing mail.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | geary | 3.38.0.1-1 | — |
| Debian 13 | geary | 3.38.0.1-1 | — |
| Debian 12 | geary | 3.38.0.1-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | geary | No fix yet | — |
| Ubuntu 18.04 LTS | geary | No fix yet | — |
| Ubuntu 16.04 LTS | geary | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | geary | 40.0-1.4 | openSUSE-SU-2024:10781-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | geary | 3.37.91-r0 | — |
| Alpine v3.23 | geary | 3.37.91-r0 | — |
| Alpine v3.22 | geary | 3.37.91-r0 | — |
| Alpine v3.21 | geary | 3.37.91-r0 | — |
| Alpine v3.20 | geary | 3.37.91-r0 | — |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | geary | 3.37.91-r0 | — |
| Alpine v3.18 | geary | 3.37.91-r0 | — |
| Alpine v3.17 | geary | 3.37.91-r0 | — |
| Alpine v3.16 | geary | 3.37.91-r0 | — |
| Alpine v3.15 | geary | 3.37.91-r0 | — |
| Alpine v3.14 | geary | 3.37.91-r0 | — |
| Alpine v3.13 | geary | 3.37.91-r0 | — |
| Alpine v3.12 | geary | 3.36.2-r1 | — |
Advisories 1
- openSUSE-SU-2024:10781-1 geary-40.0-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://gitlab.gnome.org/GNOME/geary/-/issues/866
- FEDORA-2020-d445fb484a vendor-advisory
- FEDORA-2020-95f2c5cc25 vendor-advisory
- 20200902 Cisco Jabber for Windows Information Disclosure Vulnerability vendor-advisory