CVE-2013-4166 — Sensitive Information Exposure in Evolution

CWE-200 — Sensitive Information ExposureCWE-697 — Incorrect Comparison8 documents8 sources
Severity
7.5HIGHNVD
EPSS
1.0%
top 22.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Gnome EvolutionGnome Evolution Data ServerRedhat Enterprise Linux Desktop+2 more
Timeline
PublishedFeb 6
Latest updateMay 5

Description

The gpg_ctx_add_recipient function in camel/camel-gpg-context.c in GNOME Evolution 3.8.4 and earlier and Evolution Data Server 3.9.5 and earlier does not properly select the GPG key to use for email encryption, which might cause the email to be encrypted with the wrong key and allow remote attackers to obtain sensitive information.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages7 packages

▶CVEListV5gnome/evolution_data_server3.9.5 and earlier
▶NVDgnome/evolution3.8.4
▶CVEListV5gnome/evolution3.8.4 and earlier

Patches

Patch: git.gnome.org ↗Patch: git.gnome.org ↗Patch: git.gnome.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-p34q-c63v-mp3m: The gpg_ctx_add_recipient function in camel/camel-gpg-context↗2022-05-05
▶
CVEList
CVE-2013-4166: The gpg_ctx_add_recipient function in camel/camel-gpg-context↗2020-02-06
▶
OSV
CVE-2013-4166: The gpg_ctx_add_recipient function in camel/camel-gpg-context↗2020-02-06
▶

📋Vendor Advisories

3
Ubuntu
Evolution Data Server vulnerability↗2013-07-31
▶
Red Hat
evolution: incorrect selection of recipient gpg public key for encrypted mail↗2013-07-22
▶
Debian
CVE-2013-4166: evolution - The gpg_ctx_add_recipient function in camel/camel-gpg-context.c in GNOME Evoluti...↗2013
▶

💬Community

1
Bugzilla
CVE-2013-4166 evolution: incorrect selection of recipient gpg public key for encrypted mail↗2013-06-12
▶
CVE-2013-4166 — Sensitive Information Exposure | cvebase