You are here
Home > Preporuke > Sigurnosni nedostaci programskog paketa evolution

Sigurnosni nedostaci programskog paketa evolution

by - 0

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: evolution security and bug fix update
Advisory ID: RHSA-2020:1080-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:1080
Issue date: 2020-03-31
CVE Names: CVE-2018-15587 CVE-2019-3890
=====================================================================

1. Summary:

An update for evolution, evolution-data-server, evolution-ews, and atk is
now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) – noarch, x86_64
Red Hat Enterprise Linux Client Optional (v. 7) – noarch, x86_64
Red Hat Enterprise Linux ComputeNode (v. 7) – x86_64
Red Hat Enterprise Linux ComputeNode Optional (v. 7) – noarch, x86_64
Red Hat Enterprise Linux Server (v. 7) – noarch, ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 7) – noarch, ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 7) – noarch, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 7) – noarch, x86_64

3. Description:

Evolution is a GNOME application that provides integrated email, calendar,
contact management, and communications functionality.

The evolution-data-server packages provide a unified back end for
applications which interact with contacts, tasks and calendar information.
Evolution Data Server was originally developed as a back end for the
Evolution information management application, but is now used by various
other applications.

Security Fix(es):

* evolution: specially crafted email leading to OpenPGP signatures being
spoofed for arbitrary messages (CVE-2018-15587)

* evolution-ews: all certificate errors ignored if error is ignored during
initial account setup in gnome-online-accounts (CVE-2019-3890)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 7.8 Release Notes linked from the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Evolution must be restarted for this update to
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1392567 – Sync CategoryList with mail Labels
1677650 – CVE-2018-15587 evolution: specially crafted email leading to OpenPGP signatures being spoofed for arbitrary messages
1678313 – CVE-2019-3890 evolution-ews: all certificate errors ignored if error is ignored during initial account setup in gnome-online-accounts
1753122 – GalA11yETableItem: Incorrect implementation of AtkObjectClass::ref_child()
1753123 – Leaks AtkGObjectAccessible objects

6. Package List:

Red Hat Enterprise Linux Client (v. 7):

Source:
atk-2.28.1-2.el7.src.rpm
evolution-3.28.5-8.el7.src.rpm
evolution-data-server-3.28.5-4.el7.src.rpm
evolution-ews-3.28.5-5.el7.src.rpm

noarch:
evolution-data-server-langpacks-3.28.5-4.el7.noarch.rpm
evolution-ews-langpacks-3.28.5-5.el7.noarch.rpm
evolution-help-3.28.5-8.el7.noarch.rpm
evolution-langpacks-3.28.5-8.el7.noarch.rpm

x86_64:
atk-2.28.1-2.el7.i686.rpm
atk-2.28.1-2.el7.x86_64.rpm
atk-debuginfo-2.28.1-2.el7.i686.rpm
atk-debuginfo-2.28.1-2.el7.x86_64.rpm
evolution-3.28.5-8.el7.i686.rpm
evolution-3.28.5-8.el7.x86_64.rpm
evolution-data-server-3.28.5-4.el7.i686.rpm
evolution-data-server-3.28.5-4.el7.x86_64.rpm
evolution-data-server-debuginfo-3.28.5-4.el7.i686.rpm
evolution-data-server-debuginfo-3.28.5-4.el7.x86_64.rpm
evolution-debuginfo-3.28.5-8.el7.i686.rpm
evolution-debuginfo-3.28.5-8.el7.x86_64.rpm
evolution-ews-3.28.5-5.el7.i686.rpm
evolution-ews-3.28.5-5.el7.x86_64.rpm
evolution-ews-debuginfo-3.28.5-5.el7.i686.rpm
evolution-ews-debuginfo-3.28.5-5.el7.x86_64.rpm

Red Hat Enterprise Linux Client Optional (v. 7):

noarch:
evolution-data-server-doc-3.28.5-4.el7.noarch.rpm
evolution-devel-docs-3.28.5-8.el7.noarch.rpm

x86_64:
atk-debuginfo-2.28.1-2.el7.i686.rpm
atk-debuginfo-2.28.1-2.el7.x86_64.rpm
atk-devel-2.28.1-2.el7.i686.rpm
atk-devel-2.28.1-2.el7.x86_64.rpm
evolution-bogofilter-3.28.5-8.el7.x86_64.rpm
evolution-data-server-debuginfo-3.28.5-4.el7.i686.rpm
evolution-data-server-debuginfo-3.28.5-4.el7.x86_64.rpm
evolution-data-server-devel-3.28.5-4.el7.i686.rpm
evolution-data-server-devel-3.28.5-4.el7.x86_64.rpm
evolution-data-server-perl-3.28.5-4.el7.x86_64.rpm
evolution-data-server-tests-3.28.5-4.el7.i686.rpm
evolution-data-server-tests-3.28.5-4.el7.x86_64.rpm
evolution-debuginfo-3.28.5-8.el7.i686.rpm
evolution-debuginfo-3.28.5-8.el7.x86_64.rpm
evolution-devel-3.28.5-8.el7.i686.rpm
evolution-devel-3.28.5-8.el7.x86_64.rpm
evolution-pst-3.28.5-8.el7.x86_64.rpm
evolution-spamassassin-3.28.5-8.el7.x86_64.rpm

Red Hat Enterprise Linux ComputeNode (v. 7):

Source:
atk-2.28.1-2.el7.src.rpm

x86_64:
atk-2.28.1-2.el7.i686.rpm
atk-2.28.1-2.el7.x86_64.rpm
atk-debuginfo-2.28.1-2.el7.i686.rpm
atk-debuginfo-2.28.1-2.el7.x86_64.rpm

Red Hat Enterprise Linux ComputeNode Optional (v. 7):

Source:
evolution-data-server-3.28.5-4.el7.src.rpm

noarch:
evolution-data-server-doc-3.28.5-4.el7.noarch.rpm
evolution-data-server-langpacks-3.28.5-4.el7.noarch.rpm

x86_64:
atk-debuginfo-2.28.1-2.el7.i686.rpm
atk-debuginfo-2.28.1-2.el7.x86_64.rpm
atk-devel-2.28.1-2.el7.i686.rpm
atk-devel-2.28.1-2.el7.x86_64.rpm
evolution-data-server-3.28.5-4.el7.i686.rpm
evolution-data-server-3.28.5-4.el7.x86_64.rpm
evolution-data-server-debuginfo-3.28.5-4.el7.i686.rpm
evolution-data-server-debuginfo-3.28.5-4.el7.x86_64.rpm
evolution-data-server-devel-3.28.5-4.el7.i686.rpm
evolution-data-server-devel-3.28.5-4.el7.x86_64.rpm
evolution-data-server-perl-3.28.5-4.el7.x86_64.rpm
evolution-data-server-tests-3.28.5-4.el7.i686.rpm
evolution-data-server-tests-3.28.5-4.el7.x86_64.rpm

Red Hat Enterprise Linux Server (v. 7):

Source:
atk-2.28.1-2.el7.src.rpm
evolution-data-server-3.28.5-4.el7.src.rpm

noarch:
evolution-data-server-langpacks-3.28.5-4.el7.noarch.rpm

ppc64:
atk-2.28.1-2.el7.ppc.rpm
atk-2.28.1-2.el7.ppc64.rpm
atk-debuginfo-2.28.1-2.el7.ppc.rpm
atk-debuginfo-2.28.1-2.el7.ppc64.rpm
atk-devel-2.28.1-2.el7.ppc.rpm
atk-devel-2.28.1-2.el7.ppc64.rpm
evolution-data-server-3.28.5-4.el7.ppc.rpm
evolution-data-server-3.28.5-4.el7.ppc64.rpm
evolution-data-server-debuginfo-3.28.5-4.el7.ppc.rpm
evolution-data-server-debuginfo-3.28.5-4.el7.ppc64.rpm

ppc64le:
atk-2.28.1-2.el7.ppc64le.rpm
atk-debuginfo-2.28.1-2.el7.ppc64le.rpm
atk-devel-2.28.1-2.el7.ppc64le.rpm
evolution-data-server-3.28.5-4.el7.ppc64le.rpm
evolution-data-server-debuginfo-3.28.5-4.el7.ppc64le.rpm
evolution-data-server-devel-3.28.5-4.el7.ppc64le.rpm

s390x:
atk-2.28.1-2.el7.s390.rpm
atk-2.28.1-2.el7.s390x.rpm
atk-debuginfo-2.28.1-2.el7.s390.rpm
atk-debuginfo-2.28.1-2.el7.s390x.rpm
atk-devel-2.28.1-2.el7.s390.rpm
atk-devel-2.28.1-2.el7.s390x.rpm
evolution-data-server-3.28.5-4.el7.s390.rpm
evolution-data-server-3.28.5-4.el7.s390x.rpm
evolution-data-server-debuginfo-3.28.5-4.el7.s390.rpm
evolution-data-server-debuginfo-3.28.5-4.el7.s390x.rpm

x86_64:
atk-2.28.1-2.el7.i686.rpm
atk-2.28.1-2.el7.x86_64.rpm
atk-debuginfo-2.28.1-2.el7.i686.rpm
atk-debuginfo-2.28.1-2.el7.x86_64.rpm
atk-devel-2.28.1-2.el7.i686.rpm
atk-devel-2.28.1-2.el7.x86_64.rpm
evolution-data-server-3.28.5-4.el7.i686.rpm
evolution-data-server-3.28.5-4.el7.x86_64.rpm
evolution-data-server-debuginfo-3.28.5-4.el7.i686.rpm
evolution-data-server-debuginfo-3.28.5-4.el7.x86_64.rpm
evolution-data-server-devel-3.28.5-4.el7.i686.rpm
evolution-data-server-devel-3.28.5-4.el7.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 7):

Source:
evolution-3.28.5-8.el7.src.rpm
evolution-ews-3.28.5-5.el7.src.rpm

noarch:
evolution-data-server-doc-3.28.5-4.el7.noarch.rpm
evolution-devel-docs-3.28.5-8.el7.noarch.rpm
evolution-ews-langpacks-3.28.5-5.el7.noarch.rpm
evolution-help-3.28.5-8.el7.noarch.rpm
evolution-langpacks-3.28.5-8.el7.noarch.rpm

ppc64:
evolution-data-server-debuginfo-3.28.5-4.el7.ppc.rpm
evolution-data-server-debuginfo-3.28.5-4.el7.ppc64.rpm
evolution-data-server-devel-3.28.5-4.el7.ppc.rpm
evolution-data-server-devel-3.28.5-4.el7.ppc64.rpm
evolution-data-server-perl-3.28.5-4.el7.ppc64.rpm
evolution-data-server-tests-3.28.5-4.el7.ppc.rpm
evolution-data-server-tests-3.28.5-4.el7.ppc64.rpm

ppc64le:
evolution-3.28.5-8.el7.ppc64le.rpm
evolution-bogofilter-3.28.5-8.el7.ppc64le.rpm
evolution-data-server-debuginfo-3.28.5-4.el7.ppc64le.rpm
evolution-data-server-perl-3.28.5-4.el7.ppc64le.rpm
evolution-data-server-tests-3.28.5-4.el7.ppc64le.rpm
evolution-debuginfo-3.28.5-8.el7.ppc64le.rpm
evolution-devel-3.28.5-8.el7.ppc64le.rpm
evolution-ews-3.28.5-5.el7.ppc64le.rpm
evolution-ews-debuginfo-3.28.5-5.el7.ppc64le.rpm
evolution-pst-3.28.5-8.el7.ppc64le.rpm
evolution-spamassassin-3.28.5-8.el7.ppc64le.rpm

s390x:
evolution-data-server-debuginfo-3.28.5-4.el7.s390.rpm
evolution-data-server-debuginfo-3.28.5-4.el7.s390x.rpm
evolution-data-server-devel-3.28.5-4.el7.s390.rpm
evolution-data-server-devel-3.28.5-4.el7.s390x.rpm
evolution-data-server-perl-3.28.5-4.el7.s390x.rpm
evolution-data-server-tests-3.28.5-4.el7.s390.rpm
evolution-data-server-tests-3.28.5-4.el7.s390x.rpm

x86_64:
evolution-3.28.5-8.el7.i686.rpm
evolution-3.28.5-8.el7.x86_64.rpm
evolution-bogofilter-3.28.5-8.el7.x86_64.rpm
evolution-data-server-debuginfo-3.28.5-4.el7.i686.rpm
evolution-data-server-debuginfo-3.28.5-4.el7.x86_64.rpm
evolution-data-server-perl-3.28.5-4.el7.x86_64.rpm
evolution-data-server-tests-3.28.5-4.el7.i686.rpm
evolution-data-server-tests-3.28.5-4.el7.x86_64.rpm
evolution-debuginfo-3.28.5-8.el7.i686.rpm
evolution-debuginfo-3.28.5-8.el7.x86_64.rpm
evolution-devel-3.28.5-8.el7.i686.rpm
evolution-devel-3.28.5-8.el7.x86_64.rpm
evolution-ews-3.28.5-5.el7.i686.rpm
evolution-ews-3.28.5-5.el7.x86_64.rpm
evolution-ews-debuginfo-3.28.5-5.el7.i686.rpm
evolution-ews-debuginfo-3.28.5-5.el7.x86_64.rpm
evolution-pst-3.28.5-8.el7.x86_64.rpm
evolution-spamassassin-3.28.5-8.el7.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:
atk-2.28.1-2.el7.src.rpm
evolution-3.28.5-8.el7.src.rpm
evolution-data-server-3.28.5-4.el7.src.rpm
evolution-ews-3.28.5-5.el7.src.rpm

noarch:
evolution-data-server-langpacks-3.28.5-4.el7.noarch.rpm
evolution-ews-langpacks-3.28.5-5.el7.noarch.rpm
evolution-help-3.28.5-8.el7.noarch.rpm
evolution-langpacks-3.28.5-8.el7.noarch.rpm

x86_64:
atk-2.28.1-2.el7.i686.rpm
atk-2.28.1-2.el7.x86_64.rpm
atk-debuginfo-2.28.1-2.el7.i686.rpm
atk-debuginfo-2.28.1-2.el7.x86_64.rpm
atk-devel-2.28.1-2.el7.i686.rpm
atk-devel-2.28.1-2.el7.x86_64.rpm
evolution-3.28.5-8.el7.x86_64.rpm
evolution-data-server-3.28.5-4.el7.x86_64.rpm
evolution-data-server-debuginfo-3.28.5-4.el7.x86_64.rpm
evolution-data-server-devel-3.28.5-4.el7.x86_64.rpm
evolution-debuginfo-3.28.5-8.el7.x86_64.rpm
evolution-ews-3.28.5-5.el7.x86_64.rpm
evolution-ews-debuginfo-3.28.5-5.el7.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 7):

noarch:
evolution-data-server-doc-3.28.5-4.el7.noarch.rpm
evolution-devel-docs-3.28.5-8.el7.noarch.rpm

x86_64:
evolution-bogofilter-3.28.5-8.el7.x86_64.rpm
evolution-data-server-debuginfo-3.28.5-4.el7.x86_64.rpm
evolution-data-server-perl-3.28.5-4.el7.x86_64.rpm
evolution-data-server-tests-3.28.5-4.el7.x86_64.rpm
evolution-debuginfo-3.28.5-8.el7.i686.rpm
evolution-debuginfo-3.28.5-8.el7.x86_64.rpm
evolution-devel-3.28.5-8.el7.i686.rpm
evolution-devel-3.28.5-8.el7.x86_64.rpm
evolution-pst-3.28.5-8.el7.x86_64.rpm
evolution-spamassassin-3.28.5-8.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-15587
https://access.redhat.com/security/cve/CVE-2019-3890
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.8_release_notes/index

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIVAwUBXoObqNzjgjWX9erEAQhCNw//Y/8sBGgt2HvuhTEaOtvpg+Qt0dVYiiAU
MpYT5oOS5Ob8hy/E8DESb8wq7FZyrlTATX0UZXIMGN0dh1kvrwYHvHWMVJrFSIw/
+RzvyFQopB9ljA+Gq2+mFm3/yvWCVp8ObJTJnfUjohcEPH3LrgzOYF+WSoWSKw+M
AerR2z2aKqCGX78UgXBJLuCQCaOWeeuNfaXsnach+Hk40oMaTi648AtS+mxv01n1
/d6ahjKljGdmlsL12K8570ZRUIQhjPgI1DSXTpF25BHfvDQVGUKYC42H61VbI5h3
ul0Oak4bcavLYmOwPIHjPzycVaBK9qpIbncAr5K9E9NKhBMSjwEoWJ26JoYi5hLa
y+dtqtYQZ4mXq9fJCZ044W6C9jGJ7W2tqg7soFU448VfBoyjSnfCOBv2/zP1z653
amNGHB1Oq7AQbgyqXtuS01NpwZC5fjbOT0YUPZxV2cCq5FC1avK9syxGajU5ie8e
nZ4ilWEkTKAMEoSrH50RltK4LryTTfQjj7rOW4YFmV3scAGZ16ZT+UYUo9I7pTdf
QpBGOIjYcvr79ad4fh/sLjzQqFPlssXfC6Ea1x6/REQQ1NHAS/gKIBnBwiYxj6c9
EkPP/FZf3d+ViOn/ywGk6sprEnheWQBuyIBnpQ53oTYRY+k+B04DutRbVr80EBcX
Cj0LcHiLDaE=
=xy0A
—–END PGP SIGNATURE—–

—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

Top
More in Preporuke
Sigurnosni nedostaci jezgre operacijskog sustava

Otkriveni su sigurnosni nedostaci jezgre operacijskog sustava RHEL. Otkriveni nedostaci potencijalnim udaljenim napadačima omogućuju izazivanje DoS stanja, izvršavanje proizvoljnog programskog...

Close