It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker     could abuse this flaw to get confidential information by tricking the user into connecting to a fake     server without the user noticing the difference. (CVE-2019-3890)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2022:0045 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-3890:
    It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker     could abuse this flaw to get confidential information by tricking the user into connecting to a fake     server without the user noticing the difference.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0095 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-3890:
    It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker     could abuse this flaw to get confidential information by tricking the user into connecting to a fake     server without the user noticing the difference.

    CVE-2020-14928:
    evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When     a server sends a begin TLS response, eds reads additional data and evaluates it in a TLS context, aka     response injection.

    CVE-2020-16117:
    In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL     pointer dereference by sending an invalid (e.g., minimal) CAPABILITY line on a connection attempt. This is     related to imapx_free_capability and imapx_connect_to_server.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1080 advisory.

    - Update patch for RH bug #1686408 (CVE-2018-15587: Reposition signature bar)
    - Add patch for RH bug #1686408 (CVE-2018-15587: Reposition signature bar)
    - Add patch related to evolution-ews CVE-2019-3890 (RH bug #1696762)

    evolution-ews

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-3699 advisory.

    - Add patch related to evolution-ews CVE-2019-3890 (RH bug #1696763)

    evolution-ews

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has atk packages installed that are affected by multiple vulnerabilities:

  - GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a     specially crafted email that contains a valid signature from the entity to be impersonated as an     attachment. (CVE-2018-15587)

  - It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker     could abuse this flaw to get confidential information by tricking the user into connecting to a fake     server without the user noticing the difference. (CVE-2019-3890)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.17.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.17.1 advisory.

  - When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to     Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP     connection. If such connections are available to an attacker, they can be exploited in ways that may be     surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped     with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected     (and recommended in the security guide) that this Connector would be disabled if not required. This     vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the     web application - processing any file in the web application as a JSP Further, if the web application     allowed file upload and stored those files within the web application (or the attacker was able to control     the content of the web application by some other means) then this, along with the ability to process a     file as a JSP, made remote code execution possible. It is important to note that mitigation is only     required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth     approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to     Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP     Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading     to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.
    (CVE-2020-1938)

  - rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a     certain upper-bound check, leading to a buffer overflow. (CVE-2019-17666)

  - The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-     free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c,     include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can     occur with FUSE requests. (CVE-2019-11487)

  - A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where,     the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error     occurs. When a guest is running on a host CPU affected by the TAA flaw (TAA_NO=0), but is not affected by     the MDS issue (MDS_NO=1), the guest was to clear the affected buffers by using a VERW instruction     mechanism. But when the MDS_NO=1 bit was exported to the guests, the guests did not use the VERW mechanism     to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs and requires that     host has 'TSX' enabled. Confidentiality of data is the highest threat associated with this vulnerability.
    (CVE-2019-19338)

  - The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which     allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.
    (CVE-2015-8035)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.18. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.18 advisory.

  - When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to     Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP     connection. If such connections are available to an attacker, they can be exploited in ways that may be     surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped     with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected     (and recommended in the security guide) that this Connector would be disabled if not required. This     vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the     web application - processing any file in the web application as a JSP Further, if the web application     allowed file upload and stored those files within the web application (or the attacker was able to control     the content of the web application by some other means) then this, along with the ability to process a     file as a JSP, made remote code execution possible. It is important to note that mitigation is only     required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth     approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to     Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP     Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading     to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.
    (CVE-2020-1938)

  - rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a     certain upper-bound check, leading to a buffer overflow. (CVE-2019-17666)

  - The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-     free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c,     include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can     occur with FUSE requests. (CVE-2019-11487)

  - A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where,     the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error     occurs. When a guest is running on a host CPU affected by the TAA flaw (TAA_NO=0), but is not affected by     the MDS issue (MDS_NO=1), the guest was to clear the affected buffers by using a VERW instruction     mechanism. But when the MDS_NO=1 bit was exported to the guests, the guests did not use the VERW mechanism     to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs and requires that     host has 'TSX' enabled. Confidentiality of data is the highest threat associated with this vulnerability.
    (CVE-2019-19338)

  - The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which     allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.
    (CVE-2015-8035)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3699 advisory.

  - evolution-ews: all certificate errors ignored if error is ignored during initial account setup in gnome-     online-accounts (CVE-2019-3890)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has evolution-data-server packages installed that are affected by a vulnerability:

  - It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker     could abuse this flaw to get confidential information by tricking the user into connecting to a fake     server without the user noticing the difference. (CVE-2019-3890)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has evolution-ews packages installed that are affected by a vulnerability:

  - It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker     could abuse this flaw to get confidential information by tricking the user into connecting to a fake     server without the user noticing the difference. (CVE-2019-3890)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has evolution-ews packages installed that are affected by a vulnerability:

  - It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker     could abuse this flaw to get confidential information by tricking the user into connecting to a fake     server without the user noticing the difference. (CVE-2019-3890)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has evolution-data-server packages installed that are affected by a vulnerability:

  - It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker     could abuse this flaw to get confidential information by tricking the user into connecting to a fake     server without the user noticing the difference. (CVE-2019-3890)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of evolution-data-server installed on the remote host is prior to 3.28.5-4. The version of evolution-ews installed on the remote host is prior to 3.28.5-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1475 advisory.

    It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker     could abuse this flaw to get confidential information by tricking the user into connecting to a fake     server without the user noticing the difference. (CVE-2019-3890)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

* evolution: specially crafted email leading to OpenPGP signatures being spoofed for arbitrary messages * evolution-ews: all certificate errors ignored if error is ignored during initial account setup in gnome-online-accounts

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1080 advisory.

  - GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a     specially crafted email that contains a valid signature from the entity to be impersonated as an     attachment. (CVE-2018-15587)

  - It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker     could abuse this flaw to get confidential information by tricking the user into connecting to a fake     server without the user noticing the difference. (CVE-2019-3890)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1080 advisory.

    Evolution is a GNOME application that provides integrated email, calendar, contact management, and     communications functionality.

    The evolution-data-server packages provide a unified back end for applications which interact with     contacts, tasks and calendar information. Evolution Data Server was originally developed as a back end for     the Evolution information management application, but is now used by various other applications.

    Security Fix(es):

    * evolution: specially crafted email leading to OpenPGP signatures being spoofed for arbitrary messages     (CVE-2018-15587)

    * evolution-ews: all certificate errors ignored if error is ignored during initial account setup in gnome-     online-accounts (CVE-2019-3890)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3699 advisory.

    Evolution is a GNOME application that provides integrated email, calendar, contact management, and     communications functionality.

    Security Fix(es):

    * evolution-ews: all certificate errors ignored if configured to ignore an initial error in gnome-online-     accounts creation resulting in the connection open to being viewed and modified. (CVE-2019-3890)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix for CVE-2019-3890 - SSL Certificates are not validated

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
256816	Linux Distros Unpatched Vulnerability : CVE-2019-3890	Nessus	Misc.	high
236640	Alibaba Cloud Linux 3 : 0045: evolution (ALINUX3-SA-2022:0045)	Nessus	Alibaba Cloud Linux Local Security Checks	high
236487	Alibaba Cloud Linux 3 : 0095: evolution (ALINUX3-SA-2022:0095)	Nessus	Alibaba Cloud Linux Local Security Checks	high
180723	Oracle Linux 7 : evolution (ELSA-2020-1080)	Nessus	Oracle Linux Local Security Checks	high
180673	Oracle Linux 8 : evolution (ELSA-2019-3699)	Nessus	Oracle Linux Local Security Checks	high
174092	NewStart CGSL CORE 5.05 / MAIN 5.05 : atk Multiple Vulnerabilities (NS-SA-2023-0013)	Nessus	NewStart CGSL Local Security Checks	high
164612	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.17.1)	Nessus	Misc.	critical
164595	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.18)	Nessus	Misc.	critical
145600	CentOS 8 : evolution (CESA-2019:3699)	Nessus	CentOS Local Security Checks	high
143903	NewStart CGSL CORE 5.05 / MAIN 5.05 : evolution-data-server Vulnerability (NS-SA-2020-0114)	Nessus	NewStart CGSL Local Security Checks	high
143901	NewStart CGSL CORE 5.05 / MAIN 5.05 : evolution-ews Vulnerability (NS-SA-2020-0086)	Nessus	NewStart CGSL Local Security Checks	high
143895	NewStart CGSL CORE 5.04 / MAIN 5.04 : evolution-ews Vulnerability (NS-SA-2020-0056)	Nessus	NewStart CGSL Local Security Checks	high
143892	NewStart CGSL CORE 5.04 / MAIN 5.04 : evolution-data-server Vulnerability (NS-SA-2020-0075)	Nessus	NewStart CGSL Local Security Checks	high
139862	Amazon Linux 2 : evolution-data-server, evolution-ews (ALAS-2020-1475)	Nessus	Amazon Linux Local Security Checks	high
135807	Scientific Linux Security Update : evolution on SL7.x x86_64 (20200407)	Nessus	Scientific Linux Local Security Checks	high
135332	CentOS 7 : evolution (RHSA-2020:1080)	Nessus	CentOS Local Security Checks	high
135047	RHEL 7 : evolution (RHSA-2020:1080)	Nessus	Red Hat Local Security Checks	high
130566	RHEL 8 : evolution (RHSA-2019:3699)	Nessus	Red Hat Local Security Checks	high
123803	Fedora 29 : evolution-data-server / evolution-ews (2019-3a2cc6a0b9)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2019-3890

high

Tenable Plugins

high

high

high

high

high

high

critical

critical

high

high

high

high

high

high

high

high

high

high

high