CVE-2020-24661

GNOME Geary before 3.36.3 mishandles pinned TLS certificate verification for IMAP and SMTP services using invalid TLS certificates (e.g., self-signed certificates) when the client system is not configured to use a system-provided PKCS#11 store. This allows a meddler in the middle to present a different invalid certificate to intercept incoming and outgoing mail.

• CWE-295

• https://gitlab.gnome.org/GNOME/geary/-/issues/866Exploit, Issue Tracking, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G7OTYTGND6EFOKNQJWCHKKXKSN7SM73Y/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NS6CSTOBVO5HSAR3X5CT6DS6QDHXDB26/
• https://tools.cisco.com/security/center/content/CiscoSeg/message/NS6CSTOBVO5HSAR3X5CT6DS6QDHXDB26/Broken Link
• https://gitlab.gnome.org/GNOME/geary/-/issues/866Exploit, Issue Tracking, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G7OTYTGND6EFOKNQJWCHKKXKSN7SM73Y/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NS6CSTOBVO5HSAR3X5CT6DS6QDHXDB26/
• https://tools.cisco.com/security/center/content/CiscoSeg/message/NS6CSTOBVO5HSAR3X5CT6DS6QDHXDB26/Broken Link

Published

Aug 26, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-24654In KDE Ark before 20.08.1, a crafted TAR archive with symlin…3.3
• CVE-2020-24655A race condition in the Twilio Authy 2-Factor Authentication…5.1
• CVE-2020-24656Maltego before 4.2.12 allows XXE attacks.6.5
• CVE-2020-24658Arm Compiler 5 through 5.06u6 has an error in a stack protec…7.8
• CVE-2020-24659An issue was discovered in GnuTLS before 3.6.15. A server ca…7.5
• CVE-2020-24660An issue was discovered in LemonLDAP::NG through 2.0.8, when…9.8
• CVE-2020-24662SmartStream Transaction Lifecycle Management (TLM) Reconcili…5.4
• CVE-2020-24663Trace Financial CRESTBridge <6.3.0.02 contains a stored XSS …5.4
• CVE-2020-24664The dashboard Editor in Hitachi Vantara Pentaho through 7.x …5.4
• CVE-2020-24665The Dashboard Editor in Hitachi Vantara Pentaho through 7.x …6.5
• CVE-2020-24666The Analysis Report in Hitachi Vantara Pentaho through 7.x -…5.4
• CVE-2020-24667Trace Financial CRESTBridge <6.3.0.02 contains an authentica…8.8