Re: CVE Request -- evolution -- Uses insecure (non-SSL) connection when storing the sent message into the Sent folder

[Josh Bressers <bressers () redhat com>]

Please use CVE-2011-3355

Thanks.

-- 
    JB

----- Original Message -----
> Hello Josh, Steve, vendors,
>
> it was found that Evolution, mail and calendar client, used insecure
> (non-SSL) connection when attempting to store sent email message into
> the Sent folder, when the Sent folder was located on the remote
> server.
> An attacker on the adjacent network, able to intercept the underlying
> communication could use this flaw to obtain login credentials of the
> victim.
>
> References:
> [1] https://bugzilla.gnome.org/show_bug.cgi?id=648277
> (upstream bug report)
> [2]
> http://git.gnome.org/browse/evolution-data-server/commit/?id=e0ac4d79705c
> (upstream patch)
> [3] https://bugzilla.redhat.com/show_bug.cgi?id=697904
> [4] https://bugzilla.redhat.com/show_bug.cgi?id=707848
>
> Could you allocate a CVE id for this issue?
>
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Response Team