{"id":"CVE-2021-3349","aliases":["ALPINE-CVE-2021-3349","DEBIAN-CVE-2021-3349","EUVD-2021-26680","GHSA-q5mm-jcp2-mc43"],"status":"disputed","title":"** DISPUTED ** GNOME Evolution through 3.38.3 produces a \"Valid signature\" message for an unknown...","description":"GNOME Evolution through 3.38.3 produces a \"Valid signature\" message for an unknown identifier on a previously trusted key because Evolution does not retrieve enough information from the GnuPG API. NOTE: third parties dispute the significance of this issue, and dispute whether Evolution is the best place to change this behavior","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0035,"percentile":0.28894,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-345"],"published":"2021-02-01T04:04:19Z","modified":"2026-11-03T06:32:34Z","fixes":[{"ecosystem":"Alpine:v3.13","package":"evolution","fixed_in":["3.38.4-r0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.13","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.38.4-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.46.4-2","3.46.4-2+deb12u1","3.47.2-1","3.47.3-1","3.48.0-1","3.48.1-1","3.48.2-1","3.48.3-1","3.48.4-1","3.49.2-1","3.49.2-2","3.49.2-3","3.49.3-1","3.50.0-1","3.50.1-1","3.50.2-1","3.50.3-1","3.51.2-1","3.52.0-1","3.52.1-1","3.52.1-2","3.52.1-3","3.52.1-4","3.52.2-1","3.52.2-2","3.52.3-1","3.53.2-1","3.53.3-1","3.54.0-1","3.54.1-1","3.54.2-1","3.54.3-1","3.54.3-2","3.55.1-1","3.55.1-2","3.55.2-1","3.55.3-1","3.56.0-1","3.56.1-1","3.56.2-1","3.56.2-10","3.56.2-2","3.56.2-3","3.56.2-4","3.56.2-5","3.56.2-7","3.56.2-8","3.56.2-9","3.62.0-1","3.62.1-1","3.62.1-2"]},{"source":"osv","ecosystem":"Debian:13","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.56.1-1","3.56.1-1+deb13u1","3.56.2-0+deb13u1","3.56.2-1","3.56.2-10","3.56.2-2","3.56.2-3","3.56.2-4","3.56.2-5","3.56.2-7","3.56.2-8","3.56.2-9","3.62.0-1","3.62.1-1","3.62.1-2"]},{"source":"osv","ecosystem":"Debian:14","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.56.1-1","3.56.2-1","3.56.2-10","3.56.2-2","3.56.2-3","3.56.2-4","3.56.2-5","3.56.2-7","3.56.2-8","3.56.2-9","3.62.0-1","3.62.1-1","3.62.1-2"]}],"products":[{"vendor":"gnome","product":"evolution"}],"references":[{"url":"https://gitlab.gnome.org/GNOME/evolution/-/issues/299","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://mgorny.pl/articles/evolution-uid-trust-extrapolation.html","tags":["x_refsource_MISC","x_transferred","Exploit","Technical Description","Third Party Advisory","evidence"]},{"url":"https://dev.gnupg.org/T4735","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3349"},{"url":"https://github.com/advisories/GHSA-q5mm-jcp2-mc43"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-3349","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-3349","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-3349","description":"GNOME Evolution through 3.38.3 produces a \"Valid signature\" message for an unknown identifier on a previously trusted key because Evolution does not retrieve enough information from the GnuPG API. NOTE: third parties dispute the significance of this issue, and dispute whether Evolution is the best place to change this behavior","status":"disputed","published":"2021-02-01T04:04:19Z","modified":"2024-08-03T16:53:17.551Z","updated_at":"2026-11-02T14:33:03.671751Z"}],"euvd":[{"id":"EUVD-2021-26680","description":"GNOME Evolution through 3.38.3 produces a \"Valid signature\" message for an unknown identifier on a previously trusted key because Evolution does not retrieve enough information from the GnuPG API. NOTE: third parties dispute the significance of this issue, and dispute whether Evolution is the best place to change this behavior","status":"published","published":"2021-02-01T04:04:19Z","modified":"2024-08-03T16:53:17Z","updated_at":"2026-11-03T03:25:13.052236Z"}],"ghsa":[{"id":"GHSA-q5mm-jcp2-mc43","title":"** DISPUTED ** GNOME Evolution through 3.38.3 produces a \"Valid signature\" message for an unknown...","description":"** DISPUTED ** GNOME Evolution through 3.38.3 produces a \"Valid signature\" message for an unknown identifier on a previously trusted key because Evolution does not retrieve enough information from the GnuPG API. NOTE: third parties dispute the significance of this issue, and dispute whether Evolution is the best place to change this behavior.","status":"published","published":"2022-05-24T17:40:44Z","modified":"2024-03-21T03:33:59Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:55:42.026509Z"}],"nvd":[{"id":"CVE-2021-3349","description":"GNOME Evolution through 3.38.3 produces a \"Valid signature\" message for an unknown identifier on a previously trusted key because Evolution does not retrieve enough information from the GnuPG API. NOTE: third parties dispute the significance of this issue, and dispute whether Evolution is the best place to change this behavior","status":"disputed","published":"2021-02-01T05:15:11.88Z","modified":"2026-06-17T04:04:59.137Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:06:49.660551Z"}],"osv":[{"id":"ALPINE-CVE-2021-3349","description":"GNOME Evolution through 3.38.3 produces a \"Valid signature\" message for an unknown identifier on a previously trusted key because Evolution does not retrieve enough information from the GnuPG API. NOTE: third parties dispute the significance of this issue, and dispute whether Evolution is the best place to change this behavior","status":"published","published":"2021-02-01T05:15:11.88Z","modified":"2026-11-03T06:32:34.182361919Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"CVE-2021-3349","description":"GNOME Evolution through 3.38.3 produces a \"Valid signature\" message for an unknown identifier on a previously trusted key because Evolution does not retrieve enough information from the GnuPG API. NOTE: third parties dispute the significance of this issue, and dispute whether Evolution is the best place to change this behavior","status":"published","published":"2021-02-01T05:15:11.88Z","modified":"2026-10-24T10:50:12.28392086Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:44:20.13324Z"},{"id":"DEBIAN-CVE-2021-3349","description":"GNOME Evolution through 3.38.3 produces a \"Valid signature\" message for an unknown identifier on a previously trusted key because Evolution does not retrieve enough information from the GnuPG API. NOTE: third parties dispute the significance of this issue, and dispute whether Evolution is the best place to change this behavior","status":"published","published":"2021-02-01T05:15:11.88Z","modified":"2026-10-23T18:03:29.191788018Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:35.233346Z"}]}}