Evolution Data Server: NULL Pointer Dereference Vulnerability
Summary
ALSA-2021:1752: Low: evolution security, bug fix, and enhancement update. Affects evolution-data-server-doc versions < 3.28.5-15.el8. Fixed in 3.28.5-15.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Evolution Data Server is a GNOME application that provides integrated email, calendar, contact management, and communications functionality. It serves as a unified backend for applications that interact with contacts, tasks, and calendar information. Originally developed for the Evolution information management application, it is now used by various other applications.
Vulnerability Detail
A vulnerability (CVE-2020-16117) has been discovered in the evolution-data-server package. This vulnerability allows for a NULL pointer dereference related to imapx_free_capability and imapx_connect_to_server. An attacker could exploit this vulnerability to cause a denial-of-service condition or potentially execute arbitrary code.
How To Fix
Minimum fixed version
3.28.5-15.el8
This is the first release that contains the fix.
sudo dnf update evolution-data-server-docTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The evolution-data-server package is vulnerable to a NULL pointer dereference vulnerability. To mitigate this issue, it is crucial to update the package to version 3.28.5-15.el8 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for evolution-data-server-doc →
FAQ
Evolution Data Server is a GNOME application that provides integrated email, calendar, contact management, and communications functionality. It serves as a unified backend for applications that interact with contacts, tasks, and calendar information.
This vulnerability allows for a NULL pointer dereference, which can lead to a denial-of-service condition or potential execution of arbitrary code.
To fix this vulnerability, update the evolution-data-server package to version 3.28.5-15.el8 or later.
You can obtain the updated package from the official AlmaLinux repositories.
No specific workaround has been provided for this vulnerability. It is recommended to update the package to the fixed version.
