Every CVE Search/ Get API key

CVE-2019-3890

It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An...

8.1 HighFix available

It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.99%Up 0.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 8.1

It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference.

Record
CVE-2019-3890
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness
CWE-295, CWE-296
Updated
2026-11-02
EUVDEUVD-2019-13499 8.1

It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference.

Record
EUVD-2019-13499
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-mcq7-35g4-3c5q 8.1

It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An...

It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference.

Record
GHSA-mcq7-35g4-3c5q
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness
CWE-295
Updated
2026-11-02
NVD 8.1

It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference.

Record
CVE-2019-3890
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Weakness
CWE-295, CWE-296
Updated
2026-11-02
OSV 8.1

It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference.

Record
CVE-2019-3890
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2019-3890 8.1

It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference.

Record
DEBIAN-CVE-2019-3890
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2019:3699 8.1

Red Hat Security Advisory: evolution security and bug fix update

Record
RHSA-2019:3699
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2020:1080 8.1

Red Hat Security Advisory: evolution security and bug fix update

Record
RHSA-2020:1080
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2019-3890 8.1

It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference.

Record
UBUNTU-CVE-2019-3890
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
evolution-ews
Debian:12
 before 3.30.5-1.1
3.30.5-1.1
evolution-ews
Debian:13
 before 3.30.5-1.1
3.30.5-1.1
evolution-ews
Debian:14
 before 3.30.5-1.1
3.30.5-1.1
evolution
Red Hat:enterprise_linux:8::appstream
 before 0:3.28.5-9.el8
0:3.28.5-9.el8
evolution-bogofilter
Red Hat:enterprise_linux:8::appstream
 before 0:3.28.5-9.el8
0:3.28.5-9.el8
evolution-bogofilter-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.28.5-9.el8
0:3.28.5-9.el8
evolution-data-server
Red Hat:enterprise_linux:8::appstream
 before 0:3.28.5-11.el8
0:3.28.5-11.el8
evolution-data-server-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.28.5-11.el8
0:3.28.5-11.el8
evolution-data-server-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:3.28.5-11.el8
0:3.28.5-11.el8
evolution-data-server-devel
Red Hat:enterprise_linux:8::appstream
 before 0:3.28.5-11.el8
0:3.28.5-11.el8
Show 110 moreShow less
Affected packages
PackageAffectedFixed
evolution-data-server-langpacks
Red Hat:enterprise_linux:8::appstream
 before 0:3.28.5-11.el8
0:3.28.5-11.el8
evolution-data-server-tests-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.28.5-11.el8
0:3.28.5-11.el8
evolution-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.28.5-9.el8
0:3.28.5-9.el8
evolution-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:3.28.5-9.el8
0:3.28.5-9.el8
evolution-ews
Red Hat:enterprise_linux:8::appstream
 before 0:3.28.5-5.el8
0:3.28.5-5.el8
evolution-ews-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.28.5-5.el8
0:3.28.5-5.el8
evolution-ews-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:3.28.5-5.el8
0:3.28.5-5.el8
evolution-ews-langpacks
Red Hat:enterprise_linux:8::appstream
 before 0:3.28.5-5.el8
0:3.28.5-5.el8
evolution-help
Red Hat:enterprise_linux:8::appstream
 before 0:3.28.5-9.el8
0:3.28.5-9.el8
evolution-langpacks
Red Hat:enterprise_linux:8::appstream
 before 0:3.28.5-9.el8
0:3.28.5-9.el8
evolution-pst
Red Hat:enterprise_linux:8::appstream
 before 0:3.28.5-9.el8
0:3.28.5-9.el8
evolution-pst-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.28.5-9.el8
0:3.28.5-9.el8
evolution-spamassassin
Red Hat:enterprise_linux:8::appstream
 before 0:3.28.5-9.el8
0:3.28.5-9.el8
evolution-spamassassin-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.28.5-9.el8
0:3.28.5-9.el8
evolution-bogofilter-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:3.28.5-9.el8
0:3.28.5-9.el8
evolution-data-server-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:3.28.5-11.el8
0:3.28.5-11.el8
evolution-data-server-debugsource
Red Hat:enterprise_linux:8::crb
 before 0:3.28.5-11.el8
0:3.28.5-11.el8
evolution-data-server-doc
Red Hat:enterprise_linux:8::crb
 before 0:3.28.5-11.el8
0:3.28.5-11.el8
evolution-data-server-perl
Red Hat:enterprise_linux:8::crb
 before 0:3.28.5-11.el8
0:3.28.5-11.el8
evolution-data-server-tests
Red Hat:enterprise_linux:8::crb
 before 0:3.28.5-11.el8
0:3.28.5-11.el8
evolution-data-server-tests-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:3.28.5-11.el8
0:3.28.5-11.el8
evolution-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:3.28.5-9.el8
0:3.28.5-9.el8
evolution-debugsource
Red Hat:enterprise_linux:8::crb
 before 0:3.28.5-9.el8
0:3.28.5-9.el8
evolution-devel
Red Hat:enterprise_linux:8::crb
 before 0:3.28.5-9.el8
0:3.28.5-9.el8
evolution-pst-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:3.28.5-9.el8
0:3.28.5-9.el8
evolution-spamassassin-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:3.28.5-9.el8
0:3.28.5-9.el8
atk
Red Hat:enterprise_linux:7::client
 before 0:2.28.1-2.el7
0:2.28.1-2.el7
atk-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:2.28.1-2.el7
0:2.28.1-2.el7
evolution
Red Hat:enterprise_linux:7::client
 before 0:3.28.5-8.el7
0:3.28.5-8.el7
evolution-data-server
Red Hat:enterprise_linux:7::client
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
evolution-data-server-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
evolution-data-server-langpacks
Red Hat:enterprise_linux:7::client
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
evolution-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:3.28.5-8.el7
0:3.28.5-8.el7
evolution-ews
Red Hat:enterprise_linux:7::client
 before 0:3.28.5-5.el7
0:3.28.5-5.el7
evolution-ews-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:3.28.5-5.el7
0:3.28.5-5.el7
evolution-ews-langpacks
Red Hat:enterprise_linux:7::client
 before 0:3.28.5-5.el7
0:3.28.5-5.el7
evolution-help
Red Hat:enterprise_linux:7::client
 before 0:3.28.5-8.el7
0:3.28.5-8.el7
evolution-langpacks
Red Hat:enterprise_linux:7::client
 before 0:3.28.5-8.el7
0:3.28.5-8.el7
atk-devel
Red Hat:enterprise_linux:7::client
 before 0:2.28.1-2.el7
0:2.28.1-2.el7
evolution-bogofilter
Red Hat:enterprise_linux:7::client
 before 0:3.28.5-8.el7
0:3.28.5-8.el7
evolution-data-server-devel
Red Hat:enterprise_linux:7::client
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
evolution-data-server-doc
Red Hat:enterprise_linux:7::client
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
evolution-data-server-perl
Red Hat:enterprise_linux:7::client
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
evolution-data-server-tests
Red Hat:enterprise_linux:7::client
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
evolution-devel
Red Hat:enterprise_linux:7::client
 before 0:3.28.5-8.el7
0:3.28.5-8.el7
evolution-devel-docs
Red Hat:enterprise_linux:7::client
 before 0:3.28.5-8.el7
0:3.28.5-8.el7
evolution-pst
Red Hat:enterprise_linux:7::client
 before 0:3.28.5-8.el7
0:3.28.5-8.el7
evolution-spamassassin
Red Hat:enterprise_linux:7::client
 before 0:3.28.5-8.el7
0:3.28.5-8.el7
atk
Red Hat:enterprise_linux:7::computenode
 before 0:2.28.1-2.el7
0:2.28.1-2.el7
atk-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:2.28.1-2.el7
0:2.28.1-2.el7
atk-devel
Red Hat:enterprise_linux:7::computenode
 before 0:2.28.1-2.el7
0:2.28.1-2.el7
evolution-data-server
Red Hat:enterprise_linux:7::computenode
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
evolution-data-server-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
evolution-data-server-devel
Red Hat:enterprise_linux:7::computenode
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
evolution-data-server-doc
Red Hat:enterprise_linux:7::computenode
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
evolution-data-server-langpacks
Red Hat:enterprise_linux:7::computenode
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
evolution-data-server-perl
Red Hat:enterprise_linux:7::computenode
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
evolution-data-server-tests
Red Hat:enterprise_linux:7::computenode
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
atk
Red Hat:enterprise_linux:7::server
 before 0:2.28.1-2.el7
0:2.28.1-2.el7
atk-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:2.28.1-2.el7
0:2.28.1-2.el7
atk-devel
Red Hat:enterprise_linux:7::server
 before 0:2.28.1-2.el7
0:2.28.1-2.el7
evolution-data-server
Red Hat:enterprise_linux:7::server
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
evolution-data-server-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
evolution-data-server-devel
Red Hat:enterprise_linux:7::server
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
evolution-data-server-langpacks
Red Hat:enterprise_linux:7::server
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
evolution
Red Hat:enterprise_linux:7::server
 before 0:3.28.5-8.el7
0:3.28.5-8.el7
evolution-bogofilter
Red Hat:enterprise_linux:7::server
 before 0:3.28.5-8.el7
0:3.28.5-8.el7
evolution-data-server-doc
Red Hat:enterprise_linux:7::server
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
evolution-data-server-perl
Red Hat:enterprise_linux:7::server
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
evolution-data-server-tests
Red Hat:enterprise_linux:7::server
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
evolution-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:3.28.5-8.el7
0:3.28.5-8.el7
evolution-devel
Red Hat:enterprise_linux:7::server
 before 0:3.28.5-8.el7
0:3.28.5-8.el7
evolution-devel-docs
Red Hat:enterprise_linux:7::server
 before 0:3.28.5-8.el7
0:3.28.5-8.el7
evolution-ews
Red Hat:enterprise_linux:7::server
 before 0:3.28.5-5.el7
0:3.28.5-5.el7
evolution-ews-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:3.28.5-5.el7
0:3.28.5-5.el7
evolution-ews-langpacks
Red Hat:enterprise_linux:7::server
 before 0:3.28.5-5.el7
0:3.28.5-5.el7
evolution-help
Red Hat:enterprise_linux:7::server
 before 0:3.28.5-8.el7
0:3.28.5-8.el7
evolution-langpacks
Red Hat:enterprise_linux:7::server
 before 0:3.28.5-8.el7
0:3.28.5-8.el7
evolution-pst
Red Hat:enterprise_linux:7::server
 before 0:3.28.5-8.el7
0:3.28.5-8.el7
evolution-spamassassin
Red Hat:enterprise_linux:7::server
 before 0:3.28.5-8.el7
0:3.28.5-8.el7
atk
Red Hat:enterprise_linux:7::workstation
 before 0:2.28.1-2.el7
0:2.28.1-2.el7
atk-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:2.28.1-2.el7
0:2.28.1-2.el7
atk-devel
Red Hat:enterprise_linux:7::workstation
 before 0:2.28.1-2.el7
0:2.28.1-2.el7
evolution
Red Hat:enterprise_linux:7::workstation
 before 0:3.28.5-8.el7
0:3.28.5-8.el7
evolution-data-server
Red Hat:enterprise_linux:7::workstation
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
evolution-data-server-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
evolution-data-server-devel
Red Hat:enterprise_linux:7::workstation
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
evolution-data-server-langpacks
Red Hat:enterprise_linux:7::workstation
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
evolution-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:3.28.5-8.el7
0:3.28.5-8.el7
evolution-ews
Red Hat:enterprise_linux:7::workstation
 before 0:3.28.5-5.el7
0:3.28.5-5.el7
evolution-ews-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:3.28.5-5.el7
0:3.28.5-5.el7
evolution-ews-langpacks
Red Hat:enterprise_linux:7::workstation
 before 0:3.28.5-5.el7
0:3.28.5-5.el7
evolution-help
Red Hat:enterprise_linux:7::workstation
 before 0:3.28.5-8.el7
0:3.28.5-8.el7
evolution-langpacks
Red Hat:enterprise_linux:7::workstation
 before 0:3.28.5-8.el7
0:3.28.5-8.el7
evolution-bogofilter
Red Hat:enterprise_linux:7::workstation
 before 0:3.28.5-8.el7
0:3.28.5-8.el7
evolution-data-server-doc
Red Hat:enterprise_linux:7::workstation
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
evolution-data-server-perl
Red Hat:enterprise_linux:7::workstation
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
evolution-data-server-tests
Red Hat:enterprise_linux:7::workstation
 before 0:3.28.5-4.el7
0:3.28.5-4.el7
evolution-devel
Red Hat:enterprise_linux:7::workstation
 before 0:3.28.5-8.el7
0:3.28.5-8.el7
evolution-devel-docs
Red Hat:enterprise_linux:7::workstation
 before 0:3.28.5-8.el7
0:3.28.5-8.el7
evolution-pst
Red Hat:enterprise_linux:7::workstation
 before 0:3.28.5-8.el7
0:3.28.5-8.el7
evolution-spamassassin
Red Hat:enterprise_linux:7::workstation
 before 0:3.28.5-8.el7
0:3.28.5-8.el7
evolution-ews
Ubuntu:16.04:LTS
 All versions, plus listed versions
3.16.5-0ubuntu13.18.0-33.18.2-13.18.3-13.18.5-13.18.5-1ubuntu1
 None known
evolution-ews
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.26.1-13.26.2-13.26.2-1build13.26.3-13.26.3-2
Show 4 moreShow less
3.27.90-0ubuntu13.28.0-13.28.1-13.28.5-0ubuntu0.18.04.1
 None known
evolution-ews
Ubuntu:20.04:LTS
 All versions, plus listed versions
3.34.1-13.35.91-13.35.92-13.36.0-13.36.1-1
Show 5 moreShow less
3.36.2-0ubuntu13.36.3-0ubuntu13.36.4-0ubuntu13.36.5-0ubuntu13.36.5-0ubuntu1.1
 None known
evolution-ews
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.40.4-1ubuntu13.42.0-23.42.1-13.42.3-13.43.2-13.43.3-13.44.0-1
 None known
evolution-ews
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.50.0-13.50.1-13.50.2-13.50.3-13.52.0-13.52.0-1build1
 None known
evolution-ews
Ubuntu:25.10
 All versions, plus listed versions
3.56.0-13.56.1-13.56.1-1build13.56.2-1
 None known
evolution-ews
Ubuntu:26.10
 All versions, plus listed versions
3.56.2-3
 None known
evolution-ews
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.56.2-13.56.2-23.56.2-3
 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-3890 is a high vulnerability (CVSS 8.1) in Gnome Evolution-ews, published August 1, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.99%, the 62nd percentile. Fixed in evolution-ews 3.30.5-1.1.

References

Show 21 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open