CVE-2020-24661 Security feature bypass in n/a
Geary email client fails to verify pinned TLS certificates in specific configurations, allowing attackers to intercept mail via man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-24661?
CVE-2020-24661 is a medium-severity vulnerability in Fedoraproject Fedora, published on 26 Aug 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GNOME Geary before 3.36.3 mishandles pinned TLS certificate verification for IMAP and SMTP services using invalid TLS certificates (e.g., self-signed certificates) when the client system is not configured to use a system-provided PKCS#11 store. This allows a meddler in the middle to present a different invalid certificate to intercept incoming and outgoing mail.
Weakness: CWE-295
Which versions are affected by CVE-2020-24661?
It affects 2 products.
Linux distribution packages (1)
geary openSUSE:Tumbleweed | All versions | 40.0-1.4 |
Products include Fedoraproject Fedora, Gnome Geary.
How do I fix CVE-2020-24661?
Upgrade to a fixed version.
Is CVE-2020-24661 being exploited?
There is no known exploitation of CVE-2020-24661 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as CLEANSTART-2023-LD05714, DEBIAN-CVE-2020-24661, GHSA-9q4r-jrvx-7p2q, MGASA-2020-0390, UBUNTU-CVE-2020-24661, openSUSE-SU-2024:10781-1.