CVE-2020-24661

CVE-2020-24661, security advisory, suse linux, suse, security, cve

CVE-2020-24661

Common Vulnerabilities and Exposures

[Previous] [Index] [Next]

Upstream information

CVE-2020-24661 at MITRE

Description

GNOME Geary before 3.36.3 mishandles pinned TLS certificate verification for IMAP and SMTP services using invalid TLS certificates (e.g., self-signed certificates) when the client system is not configured to use a system-provided PKCS#11 store. This allows a meddler in the middle to present a different invalid certificate to intercept incoming and outgoing mail.

---

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having moderate severity.

CVSS v2 Scores

	National Vulnerability Database
Base Score	2.6
Vector	AV:N/AC:H/Au:N/C:P/I:N/A:N
Access Vector	Network
Access Complexity	High
Authentication	None
Confidentiality Impact	Partial
Integrity Impact	None
Availability Impact	None

CVSS v3 Scores

	National Vulnerability Database
Base Score	5.9
Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector	Network
Attack Complexity	High
Privileges Required	None
User Interaction	None
Scope	Unchanged
Confidentiality Impact	High
Integrity Impact	None
Availability Impact	None
CVSSv3 Version	3.1

SUSE Bugzilla entry: 1175814 [NEW]

No SUSE Security Announcements cross referenced.

List of released packages

Product(s)	Fixed package version(s)	References
openSUSE Tumbleweed	geary >= 40.0-1.4 geary-lang >= 40.0-1.4	Patchnames: openSUSE-Tumbleweed-2024-10781

---

SUSE Timeline for this CVE

CVE page created: Wed Aug 26 21:06:55 2020
CVE page last modified: Sun Jun 16 01:12:48 2024