CVE-2020-14928 : Security Advisory and Response

Evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection."

Understanding CVE-2020-14928

This CVE involves a vulnerability in the evolution-data-server that can lead to response injection.

What is CVE-2020-14928?

The vulnerability in evolution-data-server allows for a STARTTLS buffering issue affecting SMTP and POP3, enabling response injection when additional data is read and evaluated in a TLS context.

The Impact of CVE-2020-14928

The vulnerability could be exploited by attackers to inject malicious responses into the TLS context, potentially leading to unauthorized access or data manipulation.

Technical Details of CVE-2020-14928

Evolution-data-server vulnerability details and affected systems.

Vulnerability Description

Evolution-data-server through version 3.36.3 is susceptible to a STARTTLS buffering issue that can be exploited for response injection during TLS communication.

Affected Systems and Versions

Evolution-data-server versions up to 3.36.3

Exploitation Mechanism

The vulnerability occurs when a server sends a "begin TLS" response, triggering eds to process additional data within a TLS context, allowing for response injection.

Mitigation and Prevention

Steps to mitigate and prevent exploitation of CVE-2020-14928.

Immediate Steps to Take

Update evolution-data-server to the latest patched version.
Monitor network traffic for any suspicious activities.
Implement strict TLS handling policies.

Long-Term Security Practices

Regularly update and patch software to address known vulnerabilities.
Conduct security audits and assessments to identify and mitigate potential risks.

Patching and Updates

Apply patches provided by the evolution-data-server vendor to fix the STARTTLS buffering issue and prevent response injection.