Skip to content
Fencer Vulns
medium 5.9

CVE-2020-14928 json

evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3.

published 2020-07-17 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-7064

cvss
5.9
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.6%
EPSS 2.6% chance of exploitation in 30 days, percentile 85%
public exploits
0
none known

Summary

evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection."

Patch / fix

  • evolution-data-server Debian 14, Debian 13, Debian 12 3.36.4-1

debian advisories DEBIAN-CVE-2020-14928

  • evolution-data-server Ubuntu 16.04 LTS 3.18.5-1ubuntu1.3
  • evolution-data-server Ubuntu 18.04 LTS 3.28.5-0ubuntu0.18.04.3
  • evolution-data-server Ubuntu 20.04 LTS 3.36.3-0ubuntu1.1

ubuntu advisories UBUNTU-CVE-2020-14928

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • evolution RHEL 8 3.28.5-14.el8
  • bogofilter RHEL 8 1.2.5-2.el8
  • openchange RHEL 8 2.3-26.el8
  • evolution-pst RHEL 8 3.28.5-14.el8
  • evolution-help RHEL 8 3.28.5-14.el8
  • evolution-mapi RHEL 8 3.28.3-3.el8
  • evolution-langpacks RHEL 8 3.28.5-14.el8
  • evolution-bogofilter RHEL 8 3.28.5-14.el8

red hat advisories RHSA-2020:4649

  • evolution-data-server SLE Workstation Extension 15 SP2 3.34.4-3.3.1
  • evolution-ews SLE Workstation Extension 15 SP2 3.34.4-3.3.1
  • evolution-data-server SLE Workstation Extension 12 SP5, SLE Software Development Kit 12 SP5 3.22.7-18.7.1
  • evolution-data-server SLE Workstation Extension 12 SP5 3.20.6-17.3.1

suse advisories SUSE-SU-2021:0949-1SUSE-SU-2021:0891-1SUSE-SU-2021:0885-1

  • evolution-data-server openSUSE Tumbleweed 3.40.4-1.4
  • evolution-data-server openSUSE Leap 15.2 3.34.4-lp152.2.3.1
  • evolution-ews openSUSE Leap 15.2 3.34.4-lp152.2.3.1

opensuse advisories openSUSE-SU-2024:10744-1openSUSE-SU-2021:0482-1

  • bogofilter AlmaLinux 8 1.2.5-2.el8
  • evolution-data-server-perl AlmaLinux 8 3.28.5-14.el8
  • evolution-data-server-tests AlmaLinux 8 3.28.5-14.el8

almalinux advisories ALSA-2020:4649

  • bogofilter Rocky Linux 8 1.2.5-2.el8
  • evolution-mapi Rocky Linux 8 3.28.3-3.el8

rocky linux advisories RLSA-2020:4649

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-14928 updated cvss 5.3

evolution-data-server: Response injection via STARTTLS in SMTP and POP3

  • Red Hat Enterprise Linux 5 evolution-data-server Red Hat Enterprise Linux 6 evolution-data-server
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 7 evolution-data-server, evolution-data-server-perl, evolution-data-server-tests, evolution-data-server-langpacks
    affected: no fix available “Fix deferred”
  • Red Hat CodeReady Linux Builder (v. 8) evolution-data-server-perl 3.28.5-14.el8, evolution-data-server-tests 3.28.5-14.el8 Red Hat Enterprise Linux AppStream (v. 8) openchange 2.3-26.el8, bogofilter 1.2.5-2.el8, evolution 3.28.5-14.el8, evolution-mapi 3.28.3-3.el8, evolution-pst 3.28.5-14.el8, evolution-help 3.28.5-14.el8, +6 more
    fixed: vendor fix RHSA-2020:4649

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.61% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • gitlab.gnome.org https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/226 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.