What happened
A vulnerability has been identified in evolution-data-server, which affects various editions of Red Hat Enterprise Linux (including versions 6 through 10). The flaw involves the handling of calendar attachment properties containing file:// URIs. When a calendar event with such an attachment is saved, the affected software automatically reads the local file, encodes its contents in base64, and uploads it back to the server. This procedure occurs without verifying whether the attachment originated from the server or was added locally, creating an opportunity for data exfiltration. Exploitation occurs via malicious calendar events delivered remotely, with user interaction required to open or view the malicious content. The vulnerability’s severity is deemed medium due to its potential for information leakage rather than system compromise or remote code execution, with a CVSS score of 5.7.
Who is affected
Organisations operating affected versions of Red Hat Enterprise Linux are impacted by this vulnerability. This includes deployments running Red Hat Red Hat Enterprise Linux 6, 7, 8, 9, and 10, where evolution-data-server is present and used for calendar and contact management. Any user with low privileges who can access shared CalDAV calendars and interact with calendar events may be susceptible to the attack. The vulnerability does not depend on exposed network services but relies on remote delivery of malicious calendar content and subsequent user interaction.
Recommended actions
- Implement filtering or sandboxing for web and email content to restrict or isolate malicious calendar events before they reach end users. <strong>Mitigation should focus on the delivery and rendering stages.</strong>
- Educate users on the risks of opening calendar attachments or interacting with calendar events from untrusted sources.
- Review access controls on shared calendars to limit privileges and prevent abuse by unauthorised users.
