CVE-2021-3349 Security feature bypass in n/a

Low 3.3 Published 1 Feb 2021 Updated 3 Aug 2024

GNOME Evolution incorrectly displays valid signature messages for unknown identifiers on trusted keys, bypassing cryptographic verification.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-3349?

CVE-2021-3349 is a low-severity vulnerability in n/a, published on 1 Feb 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

GNOME Evolution through 3.38.3 produces a "Valid signature" message for an unknown identifier on a previously trusted key because Evolution does not retrieve enough information from the GnuPG API. NOTE: third parties dispute the significance of this issue, and dispute whether Evolution is the best place to change this behavior

Weakness: CWE-345

Which versions are affected by CVE-2021-3349?

It affects 1 product.

Products include Gnome Evolution.

How do I fix CVE-2021-3349?

No fix has been published for CVE-2021-3349 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-3349 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-3349 exists.

Sources

Also known as DEBIAN-CVE-2021-3349, GHSA-q5mm-jcp2-mc43.