GNOME Geary before 3.36.3 mishandles pinned TLS certificate verification for IMAP and SMTP services using invalid TLS certificates (e.g., self-signed certificates) when the client system is not configured to use a system-provided PKCS#11 store. This allows a meddler in the middle to present a different invalid certificate to intercept incoming and outgoing mail.
The product does not validate, or incorrectly validates, a certificate.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Geary | Gnome | * | 3.36.3 (excluding) |
| Geary | Ubuntu | bionic | * |
| Geary | Ubuntu | trusty | * |
| Geary | Ubuntu | xenial | * |