VulnerabilityModified

CVE-2013-4166

The gpg_ctx_add_recipient function in camel/camel-gpg-context.c in GNOME Evolution 3.8.4 and earlier and Evolution Data Server 3.9.5 and earlier does not properly select the GPG key to use for email encryption, which might cause the email to be…

HIGH 7.5EPSS 1.89%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.89%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 1.89% probability · 78th percentile
CISA KEV: Not listed
Weakness: CWE-200
Affected: gnome/evolution · gnome/evolution data server · redhat/enterprise linux desktop · redhat/enterprise linux server · redhat/enterprise linux workstation
Source: secalert@redhat.com

References

http://rhn.redhat.com/errata/RHSA-2013-1540.htmlThird Party Advisory
http://seclists.org/oss-sec/2013/q3/191Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=973728Issue Tracking, Third Party Advisory
https://git.gnome.org/browse/evolution-data-server/commit/?h=gnome-3-8&id=f7059bb37dcce485d36d769142ec9515708d8ae5Patch, Vendor Advisory
https://git.gnome.org/browse/evolution-data-server/commit/?id=5d8b92c622f6927b253762ff9310479dd3ac627dPatch, Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1540.htmlThird Party Advisory
http://seclists.org/oss-sec/2013/q3/191Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=973728Issue Tracking, Third Party Advisory
https://git.gnome.org/browse/evolution-data-server/commit/?h=gnome-3-8&id=f7059bb37dcce485d36d769142ec9515708d8ae5Patch, Vendor Advisory
https://git.gnome.org/browse/evolution-data-server/commit/?id=5d8b92c622f6927b253762ff9310479dd3ac627dPatch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.