Blame SOURCES/evolution-ews-3.28.5-cve-2019-3890.patch

ae7d88
diff -up evolution-ews-3.28.5/src/addressbook/e-book-backend-ews.c.cve-2019-3890 evolution-ews-3.28.5/src/addressbook/e-book-backend-ews.c
ae7d88
--- evolution-ews-3.28.5/src/addressbook/e-book-backend-ews.c.cve-2019-3890	2019-04-15 09:43:49.672771516 +0200
ae7d88
+++ evolution-ews-3.28.5/src/addressbook/e-book-backend-ews.c	2019-04-15 09:43:49.683771516 +0200
ae7d88
@@ -2901,7 +2901,8 @@ ebb_ews_connect_sync (EBookMetaBackend *
ae7d88
 		bbews->priv->cnc, "proxy-resolver",
ae7d88
 		G_BINDING_SYNC_CREATE);
ae7d88
 
ae7d88
-	*out_auth_result = e_ews_connection_try_credentials_sync (bbews->priv->cnc, credentials, cancellable, error);
ae7d88
+	*out_auth_result = e_ews_connection_try_credentials_sync (bbews->priv->cnc, credentials, NULL,
ae7d88
+		out_certificate_pem, out_certificate_errors, cancellable, error);
ae7d88
 
ae7d88
 	if (*out_auth_result == E_SOURCE_AUTHENTICATION_ACCEPTED) {
ae7d88
 		ESource *source = e_backend_get_source (E_BACKEND (bbews));
ae7d88
diff -up evolution-ews-3.28.5/src/calendar/e-cal-backend-ews.c.cve-2019-3890 evolution-ews-3.28.5/src/calendar/e-cal-backend-ews.c
ae7d88
--- evolution-ews-3.28.5/src/calendar/e-cal-backend-ews.c.cve-2019-3890	2019-04-15 09:43:49.676771516 +0200
ae7d88
+++ evolution-ews-3.28.5/src/calendar/e-cal-backend-ews.c	2019-04-15 09:43:49.684771516 +0200
ae7d88
@@ -1394,7 +1394,8 @@ ecb_ews_connect_sync (ECalMetaBackend *m
ae7d88
 		cbews->priv->cnc, "proxy-resolver",
ae7d88
 		G_BINDING_SYNC_CREATE);
ae7d88
 
ae7d88
-	*out_auth_result = e_ews_connection_try_credentials_sync (cbews->priv->cnc, credentials, cancellable, error);
ae7d88
+	*out_auth_result = e_ews_connection_try_credentials_sync (cbews->priv->cnc, credentials, NULL,
ae7d88
+		out_certificate_pem, out_certificate_errors, cancellable, error);
ae7d88
 
ae7d88
 	if (*out_auth_result == E_SOURCE_AUTHENTICATION_ACCEPTED) {
ae7d88
 		ESource *source = e_backend_get_source (E_BACKEND (cbews));
ae7d88
diff -up evolution-ews-3.28.5/src/camel/camel-ews-store.c.cve-2019-3890 evolution-ews-3.28.5/src/camel/camel-ews-store.c
ae7d88
--- evolution-ews-3.28.5/src/camel/camel-ews-store.c.cve-2019-3890	2018-07-30 16:01:00.000000000 +0200
ae7d88
+++ evolution-ews-3.28.5/src/camel/camel-ews-store.c	2019-04-15 09:43:49.684771516 +0200
ae7d88
@@ -1831,6 +1831,8 @@ ews_authenticate_sync (CamelService *ser
ae7d88
 	const gchar *password;
ae7d88
 	gchar *hosturl;
ae7d88
 	gchar *old_sync_state = NULL, *new_sync_state = NULL;
ae7d88
+	gchar *certificate_pem = NULL;
ae7d88
+	GTlsCertificateFlags certificate_errors = 0;
ae7d88
 	GError *local_error = NULL;
ae7d88
 
ae7d88
 	ews_store = CAMEL_EWS_STORE (service);
ae7d88
@@ -1959,6 +1961,18 @@ ews_authenticate_sync (CamelService *ser
ae7d88
 
ae7d88
 	g_slist_free_full (created_folder_ids, g_free);
ae7d88
 
ae7d88
+	if (g_error_matches (local_error, SOUP_HTTP_ERROR, SOUP_STATUS_SSL_FAILED) &&
ae7d88
+	    e_ews_connection_get_ssl_error_details (connection, &certificate_pem, &certificate_errors)) {
ae7d88
+		source = e_ews_connection_get_source (connection);
ae7d88
+
ae7d88
+		if (source) {
ae7d88
+			e_source_emit_credentials_required (source, E_SOURCE_CREDENTIALS_REASON_SSL_FAILED,
ae7d88
+				certificate_pem, certificate_errors, local_error);
ae7d88
+		}
ae7d88
+
ae7d88
+		g_free (certificate_pem);
ae7d88
+	}
ae7d88
+
ae7d88
 	if (local_error == NULL) {
ae7d88
 		result = CAMEL_AUTHENTICATION_ACCEPTED;
ae7d88
 	} else if (g_error_matches (local_error, EWS_CONNECTION_ERROR, EWS_CONNECTION_ERROR_AUTHENTICATION_FAILED)) {
ae7d88
diff -up evolution-ews-3.28.5/src/collection/e-ews-backend.c.cve-2019-3890 evolution-ews-3.28.5/src/collection/e-ews-backend.c
ae7d88
--- evolution-ews-3.28.5/src/collection/e-ews-backend.c.cve-2019-3890	2019-04-15 09:43:49.679771516 +0200
ae7d88
+++ evolution-ews-3.28.5/src/collection/e-ews-backend.c	2019-04-15 09:43:49.685771516 +0200
ae7d88
@@ -727,6 +727,15 @@ ews_backend_constructed (GObject *object
ae7d88
 	/* Reset the connectable, it steals data from Authentication extension,
ae7d88
 	   where is written incorrect address */
ae7d88
 	e_backend_set_connectable (backend, NULL);
ae7d88
+
ae7d88
+	/* Eventually unset temporary SSL trust, but only once, when the process started.
ae7d88
+	   It might bee too often anywhere lease (like in the authenticate callback) */
ae7d88
+	if (e_source_has_extension (source, E_SOURCE_EXTENSION_WEBDAV_BACKEND)) {
ae7d88
+		ESourceWebdav *webdav_extension;
ae7d88
+
ae7d88
+		webdav_extension = e_source_get_extension (source, E_SOURCE_EXTENSION_WEBDAV_BACKEND);
ae7d88
+		e_source_webdav_unset_temporary_ssl_trust (webdav_extension);
ae7d88
+	}
ae7d88
 }
ae7d88
 
ae7d88
 static void
ae7d88
@@ -930,7 +939,7 @@ ews_backend_create_resource_sync (EColle
ae7d88
 	}
ae7d88
 
ae7d88
 	if (!success) {
ae7d88
-		connection = e_ews_backend_ref_connection_sync (E_EWS_BACKEND (backend), NULL, cancellable, error);
ae7d88
+		connection = e_ews_backend_ref_connection_sync (E_EWS_BACKEND (backend), NULL, NULL, NULL, cancellable, error);
ae7d88
 		if (connection == NULL)
ae7d88
 			return FALSE;
ae7d88
 
ae7d88
@@ -1037,7 +1046,7 @@ ews_backend_delete_resource_sync (EColle
ae7d88
 	const gchar *extension_name;
ae7d88
 	gboolean success = FALSE;
ae7d88
 
ae7d88
-	connection = e_ews_backend_ref_connection_sync (E_EWS_BACKEND (backend), NULL, cancellable, error);
ae7d88
+	connection = e_ews_backend_ref_connection_sync (E_EWS_BACKEND (backend), NULL, NULL, NULL, cancellable, error);
ae7d88
 	if (connection == NULL)
ae7d88
 		return FALSE;
ae7d88
 
ae7d88
@@ -1142,7 +1151,7 @@ ews_backend_authenticate_sync (EBackend
ae7d88
 	ews_backend->priv->credentials = e_named_parameters_new_clone (credentials);
ae7d88
 	g_mutex_unlock (&ews_backend->priv->connection_lock);
ae7d88
 
ae7d88
-	connection = e_ews_backend_ref_connection_sync (ews_backend, &result, cancellable, error);
ae7d88
+	connection = e_ews_backend_ref_connection_sync (ews_backend, &result, out_certificate_pem, out_certificate_errors, cancellable, error);
ae7d88
 	g_clear_object (&connection);
ae7d88
 
ae7d88
 	if (result == E_SOURCE_AUTHENTICATION_ACCEPTED) {
ae7d88
@@ -1223,7 +1232,7 @@ ews_backend_ref_connection_thread (GSimp
ae7d88
 	EEwsConnection *connection;
ae7d88
 	GError *error = NULL;
ae7d88
 
ae7d88
-	connection = e_ews_backend_ref_connection_sync (E_EWS_BACKEND (object), NULL, cancellable, &error);
ae7d88
+	connection = e_ews_backend_ref_connection_sync (E_EWS_BACKEND (object), NULL, NULL, NULL, cancellable, &error);
ae7d88
 
ae7d88
 	/* Sanity check. */
ae7d88
 	g_return_if_fail (
ae7d88
@@ -1241,6 +1250,8 @@ ews_backend_ref_connection_thread (GSimp
ae7d88
 EEwsConnection *
ae7d88
 e_ews_backend_ref_connection_sync (EEwsBackend *backend,
ae7d88
 				   ESourceAuthenticationResult *result,
ae7d88
+				   gchar **out_certificate_pem,
ae7d88
+				   GTlsCertificateFlags *out_certificate_errors,
ae7d88
                                    GCancellable *cancellable,
ae7d88
                                    GError **error)
ae7d88
 {
ae7d88
@@ -1272,7 +1283,8 @@ e_ews_backend_ref_connection_sync (EEwsB
ae7d88
 		connection, "proxy-resolver",
ae7d88
 		G_BINDING_SYNC_CREATE);
ae7d88
 
ae7d88
-	local_result = e_ews_connection_try_credentials_sync (connection, backend->priv->credentials, cancellable, error);
ae7d88
+	local_result = e_ews_connection_try_credentials_sync (connection, backend->priv->credentials, NULL,
ae7d88
+		out_certificate_pem, out_certificate_errors, cancellable, error);
ae7d88
 	if (result)
ae7d88
 		*result = local_result;
ae7d88
 
ae7d88
@@ -1413,7 +1425,7 @@ e_ews_backend_sync_folders_sync (EEwsBac
ae7d88
 		return TRUE;
ae7d88
 	}
ae7d88
 
ae7d88
-	connection = e_ews_backend_ref_connection_sync (backend, NULL, cancellable, error);
ae7d88
+	connection = e_ews_backend_ref_connection_sync (backend, NULL, NULL, NULL, cancellable, error);
ae7d88
 
ae7d88
 	if (connection == NULL) {
ae7d88
 		backend->priv->need_update_folders = TRUE;
ae7d88
diff -up evolution-ews-3.28.5/src/collection/e-ews-backend.h.cve-2019-3890 evolution-ews-3.28.5/src/collection/e-ews-backend.h
ae7d88
--- evolution-ews-3.28.5/src/collection/e-ews-backend.h.cve-2019-3890	2018-07-30 16:01:00.000000000 +0200
ae7d88
+++ evolution-ews-3.28.5/src/collection/e-ews-backend.h	2019-04-15 09:43:49.685771516 +0200
ae7d88
@@ -63,6 +63,8 @@ EEwsConnection *
ae7d88
 		e_ews_backend_ref_connection_sync
ae7d88
 						(EEwsBackend *backend,
ae7d88
 						 ESourceAuthenticationResult *result,
ae7d88
+						 gchar **out_certificate_pem,
ae7d88
+						 GTlsCertificateFlags *out_certificate_errors,
ae7d88
 						 GCancellable *cancellable,
ae7d88
 						 GError **error);
ae7d88
 void		e_ews_backend_ref_connection	(EEwsBackend *backend,
ae7d88
diff -up evolution-ews-3.28.5/src/configuration/e-ews-config-lookup.c.cve-2019-3890 evolution-ews-3.28.5/src/configuration/e-ews-config-lookup.c
ae7d88
--- evolution-ews-3.28.5/src/configuration/e-ews-config-lookup.c.cve-2019-3890	2018-07-30 16:01:00.000000000 +0200
ae7d88
+++ evolution-ews-3.28.5/src/configuration/e-ews-config-lookup.c	2019-04-15 09:43:49.685771516 +0200
ae7d88
@@ -344,9 +344,54 @@ ews_config_lookup_worker_run (EConfigLoo
ae7d88
 
ae7d88
 	if (password) {
ae7d88
 		const gchar *servers;
ae7d88
+		gchar *certificate_host = NULL;
ae7d88
+		gchar *certificate_pem = NULL;
ae7d88
+		GTlsCertificateFlags certificate_errors = 0;
ae7d88
+		GError *local_error = NULL;
ae7d88
+
ae7d88
+		if (e_named_parameters_exists (params, E_CONFIG_LOOKUP_PARAM_CERTIFICATE_PEM) &&
ae7d88
+		    e_named_parameters_exists (params, E_CONFIG_LOOKUP_PARAM_CERTIFICATE_TRUST) &&
ae7d88
+		    e_named_parameters_exists (params, E_CONFIG_LOOKUP_PARAM_CERTIFICATE_HOST)) {
ae7d88
+			GTlsCertificate *certificate;
ae7d88
+			const gchar *param_certificate_pem;
ae7d88
+
ae7d88
+			param_certificate_pem = e_named_parameters_get (params, E_CONFIG_LOOKUP_PARAM_CERTIFICATE_PEM);
ae7d88
+			certificate = g_tls_certificate_new_from_pem (param_certificate_pem, -1, NULL);
ae7d88
+
ae7d88
+			if (certificate) {
ae7d88
+				ETrustPromptResponse trust_response;
ae7d88
+
ae7d88
+				trust_response = e_config_lookup_decode_certificate_trust (
ae7d88
+					e_named_parameters_get (params, E_CONFIG_LOOKUP_PARAM_CERTIFICATE_TRUST));
ae7d88
+
ae7d88
+				if (trust_response != E_TRUST_PROMPT_RESPONSE_UNKNOWN) {
ae7d88
+					ESourceWebdav *webdav_extension;
ae7d88
+
ae7d88
+					webdav_extension = e_source_get_extension (source, E_SOURCE_EXTENSION_WEBDAV_BACKEND);
ae7d88
+					e_source_webdav_update_ssl_trust (webdav_extension,
ae7d88
+						e_named_parameters_get (params, E_CONFIG_LOOKUP_PARAM_CERTIFICATE_HOST),
ae7d88
+						certificate, trust_response);
ae7d88
+				}
ae7d88
+
ae7d88
+				g_object_unref (certificate);
ae7d88
+			}
ae7d88
+		}
ae7d88
 
ae7d88
-		if (e_ews_autodiscover_ws_url_sync (source, ews_settings, email_address, password, cancellable, NULL)) {
ae7d88
+		if (e_ews_autodiscover_ws_url_sync (source, ews_settings, email_address, password, &certificate_pem, &certificate_errors, cancellable, &local_error)) {
ae7d88
 			ews_config_lookup_worker_result_from_settings (lookup_worker, config_lookup, email_address, ews_settings, params);
ae7d88
+		} else if (g_error_matches (local_error, SOUP_HTTP_ERROR, SOUP_STATUS_SSL_FAILED)) {
ae7d88
+			const gchar *hosturl;
ae7d88
+			SoupURI *suri;
ae7d88
+
ae7d88
+			hosturl = camel_ews_settings_get_hosturl (ews_settings);
ae7d88
+			suri = soup_uri_new (hosturl);
ae7d88
+			if (suri) {
ae7d88
+				certificate_host = g_strdup (soup_uri_get_host (suri));
ae7d88
+
ae7d88
+				soup_uri_free (suri);
ae7d88
+			}
ae7d88
+		} else {
ae7d88
+			g_clear_error (&local_error);
ae7d88
 		}
ae7d88
 
ae7d88
 		servers = e_named_parameters_get (params, E_CONFIG_LOOKUP_PARAM_SERVERS);
ae7d88
@@ -357,7 +402,7 @@ ews_config_lookup_worker_run (EConfigLoo
ae7d88
 
ae7d88
 			servers_strv = g_strsplit (servers, ";", 0);
ae7d88
 
ae7d88
-			for (ii = 0; servers_strv && servers_strv[ii] && !g_cancellable_is_cancelled (cancellable); ii++) {
ae7d88
+			for (ii = 0; servers_strv && servers_strv[ii] && !g_cancellable_is_cancelled (cancellable) && !local_error; ii++) {
ae7d88
 				const gchar *server = servers_strv[ii];
ae7d88
 				gchar *tmp = NULL;
ae7d88
 
ae7d88
@@ -368,8 +413,21 @@ ews_config_lookup_worker_run (EConfigLoo
ae7d88
 
ae7d88
 				camel_ews_settings_set_hosturl (ews_settings, server);
ae7d88
 
ae7d88
-				if (e_ews_autodiscover_ws_url_sync (source, ews_settings, email_address, password, cancellable, NULL)) {
ae7d88
+				if (e_ews_autodiscover_ws_url_sync (source, ews_settings, email_address, password, &certificate_pem, &certificate_errors, cancellable, &local_error)) {
ae7d88
 					ews_config_lookup_worker_result_from_settings (lookup_worker, config_lookup, email_address, ews_settings, params);
ae7d88
+				} else if (g_error_matches (local_error, SOUP_HTTP_ERROR, SOUP_STATUS_SSL_FAILED)) {
ae7d88
+					const gchar *hosturl;
ae7d88
+					SoupURI *suri;
ae7d88
+
ae7d88
+					hosturl = camel_ews_settings_get_hosturl (ews_settings);
ae7d88
+					suri = soup_uri_new (hosturl);
ae7d88
+					if (suri) {
ae7d88
+						certificate_host = g_strdup (soup_uri_get_host (suri));
ae7d88
+
ae7d88
+						soup_uri_free (suri);
ae7d88
+					}
ae7d88
+				} else {
ae7d88
+					g_clear_error (&local_error);
ae7d88
 				}
ae7d88
 
ae7d88
 				g_free (tmp);
ae7d88
@@ -378,7 +436,31 @@ ews_config_lookup_worker_run (EConfigLoo
ae7d88
 			g_strfreev (servers_strv);
ae7d88
 		}
ae7d88
 
ae7d88
-		if (out_restart_params)
ae7d88
+		if (g_error_matches (local_error, SOUP_HTTP_ERROR, SOUP_STATUS_SSL_FAILED) &&
ae7d88
+		    certificate_pem && *certificate_pem && certificate_errors) {
ae7d88
+			gchar *description = e_trust_prompt_describe_certificate_errors (certificate_errors);
ae7d88
+
ae7d88
+			if (description) {
ae7d88
+				g_set_error_literal (error, E_CONFIG_LOOKUP_WORKER_ERROR,
ae7d88
+					E_CONFIG_LOOKUP_WORKER_ERROR_CERTIFICATE, description);
ae7d88
+
ae7d88
+				g_free (description);
ae7d88
+
ae7d88
+				if (out_restart_params) {
ae7d88
+					if (!*out_restart_params)
ae7d88
+						*out_restart_params = e_named_parameters_new_clone (params);
ae7d88
+
ae7d88
+					e_named_parameters_set (*out_restart_params, E_CONFIG_LOOKUP_PARAM_CERTIFICATE_PEM, certificate_pem);
ae7d88
+					e_named_parameters_set (*out_restart_params, E_CONFIG_LOOKUP_PARAM_CERTIFICATE_HOST, certificate_host);
ae7d88
+				}
ae7d88
+			}
ae7d88
+		}
ae7d88
+
ae7d88
+		g_clear_error (&local_error);
ae7d88
+		g_free (certificate_host);
ae7d88
+		g_free (certificate_pem);
ae7d88
+
ae7d88
+		if (out_restart_params && !*out_restart_params)
ae7d88
 			*out_restart_params = e_named_parameters_new_clone (params);
ae7d88
 	}
ae7d88
 
ae7d88
diff -up evolution-ews-3.28.5/src/configuration/e-ews-config-utils.c.cve-2019-3890 evolution-ews-3.28.5/src/configuration/e-ews-config-utils.c
ae7d88
--- evolution-ews-3.28.5/src/configuration/e-ews-config-utils.c.cve-2019-3890	2018-07-30 16:01:00.000000000 +0200
ae7d88
+++ evolution-ews-3.28.5/src/configuration/e-ews-config-utils.c	2019-04-15 09:43:49.686771516 +0200
ae7d88
@@ -317,7 +317,7 @@ ews_config_utils_try_credentials_sync (E
ae7d88
 	if (data->try_credentials_func)
ae7d88
 		auth_result = data->try_credentials_func (data->conn, credentials, data->user_data, cancellable, error);
ae7d88
 	else
ae7d88
-		auth_result = e_ews_connection_try_credentials_sync (data->conn, credentials, cancellable, error);
ae7d88
+		auth_result = e_ews_connection_try_credentials_sync (data->conn, credentials, NULL, NULL, NULL, cancellable, error);
ae7d88
 
ae7d88
 	if (auth_result == E_SOURCE_AUTHENTICATION_ACCEPTED) {
ae7d88
 		*out_authenticated = TRUE;
ae7d88
@@ -377,7 +377,7 @@ e_ews_config_utils_open_connection_for (
ae7d88
 			if (try_credentials_func)
ae7d88
 				result = try_credentials_func (conn, NULL, user_data, cancellable, &local_error);
ae7d88
 			else
ae7d88
-				result = e_ews_connection_try_credentials_sync (conn, NULL, cancellable, &local_error);
ae7d88
+				result = e_ews_connection_try_credentials_sync (conn, NULL, NULL, NULL, NULL, cancellable, &local_error);
ae7d88
 
ae7d88
 			if (result != E_SOURCE_AUTHENTICATION_ACCEPTED) {
ae7d88
 				g_clear_object (&conn;;
ae7d88
diff -up evolution-ews-3.28.5/src/configuration/e-mail-config-ews-autodiscover.c.cve-2019-3890 evolution-ews-3.28.5/src/configuration/e-mail-config-ews-autodiscover.c
ae7d88
--- evolution-ews-3.28.5/src/configuration/e-mail-config-ews-autodiscover.c.cve-2019-3890	2018-07-30 16:01:00.000000000 +0200
ae7d88
+++ evolution-ews-3.28.5/src/configuration/e-mail-config-ews-autodiscover.c	2019-04-15 09:43:49.686771516 +0200
ae7d88
@@ -45,6 +45,8 @@ struct _AsyncContext {
ae7d88
 	ESource *source;
ae7d88
 	CamelEwsSettings *ews_settings;
ae7d88
 	gchar *email_address;
ae7d88
+	gchar *certificate_pem;
ae7d88
+	GTlsCertificateFlags certificate_errors;
ae7d88
 };
ae7d88
 
ae7d88
 enum {
ae7d88
@@ -67,6 +69,7 @@ async_context_free (gpointer ptr)
ae7d88
 	g_clear_object (&async_context->source);
ae7d88
 	g_clear_object (&async_context->ews_settings);
ae7d88
 	g_free (async_context->email_address);
ae7d88
+	g_free (async_context->certificate_pem);
ae7d88
 
ae7d88
 	g_slice_free (AsyncContext, async_context);
ae7d88
 }
ae7d88
@@ -87,6 +90,9 @@ mail_config_ews_autodiscover_finish (EMa
ae7d88
 }
ae7d88
 
ae7d88
 static void
ae7d88
+mail_config_ews_autodiscover_run (EMailConfigEwsAutodiscover *autodiscover);
ae7d88
+
ae7d88
+static void
ae7d88
 mail_config_ews_autodiscover_run_cb (GObject *source_object,
ae7d88
                                      GAsyncResult *result,
ae7d88
                                      gpointer user_data)
ae7d88
@@ -111,17 +117,62 @@ mail_config_ews_autodiscover_run_cb (GOb
ae7d88
 	g_object_thaw_notify (G_OBJECT (settings));
ae7d88
 
ae7d88
 	if (e_activity_handle_cancellation (async_context->activity, error)) {
ae7d88
-		g_error_free (error);
ae7d88
+		/* Do nothing, just free the error below */
ae7d88
+	} else if (g_error_matches (error, SOUP_HTTP_ERROR, SOUP_STATUS_SSL_FAILED) &&
ae7d88
+		   async_context->certificate_pem && *async_context->certificate_pem && async_context->certificate_errors) {
ae7d88
+		ETrustPromptResponse response;
ae7d88
+		GtkWidget *parent;
ae7d88
+		const gchar *host;
ae7d88
+
ae7d88
+		parent = gtk_widget_get_toplevel (GTK_WIDGET (autodiscover));
ae7d88
+		if (!GTK_IS_WINDOW (parent))
ae7d88
+			parent = NULL;
ae7d88
+
ae7d88
+		host = camel_network_settings_get_host (CAMEL_NETWORK_SETTINGS (settings));
ae7d88
+
ae7d88
+		response = e_trust_prompt_run_modal (parent ? GTK_WINDOW (parent) : NULL,
ae7d88
+			E_SOURCE_EXTENSION_COLLECTION, _("Exchange Web Services"),
ae7d88
+			host, async_context->certificate_pem, async_context->certificate_errors,
ae7d88
+			error->message);
ae7d88
+
ae7d88
+		g_clear_error (&error);
ae7d88
+
ae7d88
+		if (response != E_TRUST_PROMPT_RESPONSE_UNKNOWN) {
ae7d88
+			GTlsCertificate *certificate;
ae7d88
+
ae7d88
+			certificate = g_tls_certificate_new_from_pem (async_context->certificate_pem, -1, &error);
ae7d88
+			if (certificate) {
ae7d88
+				ESourceWebdav *extension_webdav;
ae7d88
+
ae7d88
+				extension_webdav = e_source_get_extension (async_context->source, E_SOURCE_EXTENSION_WEBDAV_BACKEND);
ae7d88
+
ae7d88
+				e_source_webdav_update_ssl_trust (extension_webdav, host, certificate, response);
ae7d88
+
ae7d88
+				g_object_unref (certificate);
ae7d88
+			}
ae7d88
+
ae7d88
+			if (error) {
ae7d88
+				e_alert_submit (
ae7d88
+					alert_sink,
ae7d88
+					"ews:autodiscovery-error",
ae7d88
+					error->message, NULL);
ae7d88
+			}
ae7d88
+		}
ae7d88
 
ae7d88
+		if (response == E_TRUST_PROMPT_RESPONSE_ACCEPT ||
ae7d88
+		    response == E_TRUST_PROMPT_RESPONSE_ACCEPT_TEMPORARILY) {
ae7d88
+			mail_config_ews_autodiscover_run (autodiscover);
ae7d88
+		}
ae7d88
 	} else if (error != NULL) {
ae7d88
 		e_alert_submit (
ae7d88
 			alert_sink,
ae7d88
 			"ews:autodiscovery-error",
ae7d88
 			error->message, NULL);
ae7d88
-		g_error_free (error);
ae7d88
 	}
ae7d88
 
ae7d88
 	gtk_widget_set_sensitive (GTK_WIDGET (autodiscover), TRUE);
ae7d88
+
ae7d88
+	g_clear_error (&error);
ae7d88
 }
ae7d88
 
ae7d88
 static gboolean
ae7d88
@@ -141,6 +192,7 @@ mail_config_ews_autodiscover_sync (ECred
ae7d88
 		async_context->ews_settings, async_context->email_address,
ae7d88
 		credentials && e_named_parameters_get (credentials, E_SOURCE_CREDENTIAL_PASSWORD) ?
ae7d88
 		e_named_parameters_get (credentials, E_SOURCE_CREDENTIAL_PASSWORD) : "",
ae7d88
+		&async_context->certificate_pem, &async_context->certificate_errors,
ae7d88
 		cancellable, &local_error);
ae7d88
 
ae7d88
 	if (local_error == NULL) {
ae7d88
@@ -173,6 +225,7 @@ mail_config_ews_autodiscover_run_thread
ae7d88
 		if (without_password) {
ae7d88
 			success = e_ews_autodiscover_ws_url_sync (async_context->source,
ae7d88
 				async_context->ews_settings, async_context->email_address, "",
ae7d88
+				&async_context->certificate_pem, &async_context->certificate_errors,
ae7d88
 				cancellable, &local_error);
ae7d88
 		}
ae7d88
 
ae7d88
@@ -236,6 +289,8 @@ mail_config_ews_autodiscover_run (EMailC
ae7d88
 	async_context->source = g_object_ref (source);
ae7d88
 	async_context->ews_settings = g_object_ref (settings);
ae7d88
 	async_context->email_address = g_strdup (e_mail_config_service_page_get_email_address (page));
ae7d88
+	async_context->certificate_pem = NULL;
ae7d88
+	async_context->certificate_errors = 0;
ae7d88
 
ae7d88
 	/*
ae7d88
 	 * The GTask will be run in a new thread, which will invoke
ae7d88
diff -up evolution-ews-3.28.5/src/server/e-ews-connection.c.cve-2019-3890 evolution-ews-3.28.5/src/server/e-ews-connection.c
ae7d88
--- evolution-ews-3.28.5/src/server/e-ews-connection.c.cve-2019-3890	2018-07-30 16:01:00.000000000 +0200
ae7d88
+++ evolution-ews-3.28.5/src/server/e-ews-connection.c	2019-04-15 09:43:49.689771516 +0200
ae7d88
@@ -111,6 +111,10 @@ struct _EEwsConnectionPrivate {
ae7d88
 
ae7d88
 	/* Set to TRUE when this connection had been disconnected and cannot be used anymore */
ae7d88
 	gboolean disconnected_flag;
ae7d88
+
ae7d88
+	gboolean ssl_info_set;
ae7d88
+	gchar *ssl_certificate_pem;
ae7d88
+	GTlsCertificateFlags ssl_certificate_errors;
ae7d88
 };
ae7d88
 
ae7d88
 enum {
ae7d88
@@ -836,6 +840,37 @@ ews_connection_credentials_failed (EEwsC
ae7d88
 	return expired;
ae7d88
 }
ae7d88
 
ae7d88
+static void
ae7d88
+ews_connection_check_ssl_error (EEwsConnection *connection,
ae7d88
+				SoupMessage *message)
ae7d88
+{
ae7d88
+	g_return_if_fail (E_IS_EWS_CONNECTION (connection));
ae7d88
+	g_return_if_fail (SOUP_IS_MESSAGE (message));
ae7d88
+
ae7d88
+	if (message->status_code == SOUP_STATUS_SSL_FAILED) {
ae7d88
+		GTlsCertificate *certificate = NULL;
ae7d88
+
ae7d88
+		g_mutex_lock (&connection->priv->property_lock);
ae7d88
+
ae7d88
+		g_clear_pointer (&connection->priv->ssl_certificate_pem, g_free);
ae7d88
+		connection->priv->ssl_info_set = FALSE;
ae7d88
+
ae7d88
+		g_object_get (G_OBJECT (message),
ae7d88
+			"tls-certificate", &certificate,
ae7d88
+			"tls-errors", &connection->priv->ssl_certificate_errors,
ae7d88
+			NULL);
ae7d88
+
ae7d88
+		if (certificate) {
ae7d88
+			g_object_get (certificate, "certificate-pem", &connection->priv->ssl_certificate_pem, NULL);
ae7d88
+			connection->priv->ssl_info_set = TRUE;
ae7d88
+
ae7d88
+			g_object_unref (certificate);
ae7d88
+		}
ae7d88
+
ae7d88
+		g_mutex_unlock (&connection->priv->property_lock);
ae7d88
+	}
ae7d88
+}
ae7d88
+
ae7d88
 /* Response callbacks */
ae7d88
 
ae7d88
 static void
ae7d88
@@ -852,8 +887,15 @@ ews_response_cb (SoupSession *session,
ae7d88
 	if (g_cancellable_is_cancelled (enode->cancellable))
ae7d88
 		goto exit;
ae7d88
 
ae7d88
+	ews_connection_check_ssl_error (enode->cnc, msg);
ae7d88
+
ae7d88
 	if (ews_connection_credentials_failed (enode->cnc, msg, enode->simple)) {
ae7d88
 		goto exit;
ae7d88
+	} else if (msg->status_code == SOUP_STATUS_SSL_FAILED) {
ae7d88
+		g_simple_async_result_set_error (
ae7d88
+			enode->simple, SOUP_HTTP_ERROR, SOUP_STATUS_SSL_FAILED,
ae7d88
+			"%s", msg->reason_phrase);
ae7d88
+		goto exit;
ae7d88
 	} else if (msg->status_code == SOUP_STATUS_UNAUTHORIZED) {
ae7d88
 		if (msg->response_headers) {
ae7d88
 			const gchar *diagnostics;
ae7d88
@@ -1855,6 +1897,9 @@ ews_connection_constructed (GObject *obj
ae7d88
 	cnc->priv->soup_thread = g_thread_new (NULL, e_ews_soup_thread, cnc);
ae7d88
 
ae7d88
 	cnc->priv->soup_session = soup_session_async_new_with_options (
ae7d88
+		SOUP_SESSION_TIMEOUT, 90,
ae7d88
+		SOUP_SESSION_SSL_STRICT, TRUE,
ae7d88
+		SOUP_SESSION_SSL_USE_SYSTEM_CA_FILE, TRUE,
ae7d88
 		SOUP_SESSION_ASYNC_CONTEXT, cnc->priv->soup_context,
ae7d88
 		NULL);
ae7d88
 
ae7d88
@@ -1971,6 +2016,7 @@ ews_connection_finalize (GObject *object
ae7d88
 	g_free (priv->email);
ae7d88
 	g_free (priv->hash_key);
ae7d88
 	g_free (priv->impersonate_user);
ae7d88
+	g_free (priv->ssl_certificate_pem);
ae7d88
 
ae7d88
 	g_clear_object (&priv->bearer_auth);
ae7d88
 
ae7d88
@@ -2557,10 +2603,15 @@ e_ews_connection_update_credentials (EEw
ae7d88
 ESourceAuthenticationResult
ae7d88
 e_ews_connection_try_credentials_sync (EEwsConnection *cnc,
ae7d88
 				       const ENamedParameters *credentials,
ae7d88
+				       ESource *use_source,
ae7d88
+				       gchar **out_certificate_pem,
ae7d88
+				       GTlsCertificateFlags *out_certificate_errors,
ae7d88
 				       GCancellable *cancellable,
ae7d88
 				       GError **error)
ae7d88
 {
ae7d88
 	ESourceAuthenticationResult result;
ae7d88
+	ESource *source;
ae7d88
+	gboolean de_set_source;
ae7d88
 	EwsFolderId *fid = NULL;
ae7d88
 	GSList *ids = NULL;
ae7d88
 	GError *local_error = NULL;
ae7d88
@@ -2574,14 +2625,31 @@ e_ews_connection_try_credentials_sync (E
ae7d88
 	fid->is_distinguished_id = TRUE;
ae7d88
 	ids = g_slist_append (ids, fid);
ae7d88
 
ae7d88
+	source = e_ews_connection_get_source (cnc);
ae7d88
+	if (use_source && use_source != source) {
ae7d88
+		cnc->priv->source = g_object_ref (use_source);
ae7d88
+		de_set_source = TRUE;
ae7d88
+	} else {
ae7d88
+		source = NULL;
ae7d88
+		de_set_source = FALSE;
ae7d88
+	}
ae7d88
+
ae7d88
 	e_ews_connection_get_folder_sync (
ae7d88
 		cnc, EWS_PRIORITY_MEDIUM, "Default",
ae7d88
 		NULL, ids, NULL, cancellable, &local_error);
ae7d88
 
ae7d88
+	if (de_set_source) {
ae7d88
+		g_clear_object (&cnc->priv->source);
ae7d88
+		cnc->priv->source = source;
ae7d88
+	}
ae7d88
+
ae7d88
 	g_slist_free_full (ids, (GDestroyNotify) e_ews_folder_id_free);
ae7d88
 
ae7d88
 	if (local_error == NULL) {
ae7d88
 		result = E_SOURCE_AUTHENTICATION_ACCEPTED;
ae7d88
+	} else if (g_error_matches (local_error, SOUP_HTTP_ERROR, SOUP_STATUS_SSL_FAILED) &&
ae7d88
+		   e_ews_connection_get_ssl_error_details (cnc, out_certificate_pem, out_certificate_errors)) {
ae7d88
+		result = E_SOURCE_AUTHENTICATION_ERROR_SSL_FAILED;
ae7d88
 	} else {
ae7d88
 		gboolean auth_failed;
ae7d88
 
ae7d88
@@ -2618,6 +2686,29 @@ e_ews_connection_get_source (EEwsConnect
ae7d88
 	return cnc->priv->source;
ae7d88
 }
ae7d88
 
ae7d88
+gboolean
ae7d88
+e_ews_connection_get_ssl_error_details (EEwsConnection *cnc,
ae7d88
+					gchar **out_certificate_pem,
ae7d88
+					GTlsCertificateFlags *out_certificate_errors)
ae7d88
+{
ae7d88
+	g_return_val_if_fail (E_IS_EWS_CONNECTION (cnc), FALSE);
ae7d88
+	g_return_val_if_fail (out_certificate_pem != NULL, FALSE);
ae7d88
+	g_return_val_if_fail (out_certificate_errors != NULL, FALSE);
ae7d88
+
ae7d88
+	g_mutex_lock (&cnc->priv->property_lock);
ae7d88
+	if (!cnc->priv->ssl_info_set) {
ae7d88
+		g_mutex_unlock (&cnc->priv->property_lock);
ae7d88
+		return FALSE;
ae7d88
+	}
ae7d88
+
ae7d88
+	*out_certificate_pem = g_strdup (cnc->priv->ssl_certificate_pem);
ae7d88
+	*out_certificate_errors = cnc->priv->ssl_certificate_errors;
ae7d88
+
ae7d88
+	g_mutex_unlock (&cnc->priv->property_lock);
ae7d88
+
ae7d88
+	return TRUE;
ae7d88
+}
ae7d88
+
ae7d88
 const gchar *
ae7d88
 e_ews_connection_get_uri (EEwsConnection *cnc)
ae7d88
 {
ae7d88
@@ -2906,6 +2997,9 @@ autodiscover_response_cb (SoupSession *s
ae7d88
 			g_set_error (
ae7d88
 				&error, SOUP_HTTP_ERROR, status,
ae7d88
 				"%d %s", status, msg->reason_phrase);
ae7d88
+
ae7d88
+			if (status == SOUP_STATUS_SSL_FAILED)
ae7d88
+				ews_connection_check_ssl_error (ad->cnc, msg);
ae7d88
 		}
ae7d88
 
ae7d88
 		g_free (service_url);
ae7d88
@@ -3056,7 +3150,8 @@ static void post_restarted (SoupMessage
ae7d88
 }
ae7d88
 
ae7d88
 static SoupMessage *
ae7d88
-e_ews_get_msg_for_url (CamelEwsSettings *settings,
ae7d88
+e_ews_get_msg_for_url (EEwsConnection *cnc,
ae7d88
+		       CamelEwsSettings *settings,
ae7d88
 		       const gchar *url,
ae7d88
                        xmlOutputBuffer *buf,
ae7d88
                        GError **error)
ae7d88
@@ -3078,6 +3173,9 @@ e_ews_get_msg_for_url (CamelEwsSettings
ae7d88
 		return NULL;
ae7d88
 	}
ae7d88
 
ae7d88
+	if (cnc->priv->source)
ae7d88
+		e_soup_ssl_trust_connect (msg, cnc->priv->source);
ae7d88
+
ae7d88
 	e_ews_message_attach_chunk_allocator (msg);
ae7d88
 
ae7d88
 	e_ews_message_set_user_agent_header (msg, settings);
ae7d88
@@ -3107,6 +3205,8 @@ e_ews_autodiscover_ws_url_sync (ESource
ae7d88
 				CamelEwsSettings *settings,
ae7d88
                                 const gchar *email_address,
ae7d88
                                 const gchar *password,
ae7d88
+				gchar **out_certificate_pem,
ae7d88
+				GTlsCertificateFlags *out_certificate_errors,
ae7d88
                                 GCancellable *cancellable,
ae7d88
                                 GError **error)
ae7d88
 {
ae7d88
@@ -3125,7 +3225,7 @@ e_ews_autodiscover_ws_url_sync (ESource
ae7d88
 
ae7d88
 	result = e_async_closure_wait (closure);
ae7d88
 
ae7d88
-	success = e_ews_autodiscover_ws_url_finish (settings, result, error);
ae7d88
+	success = e_ews_autodiscover_ws_url_finish (settings, result, out_certificate_pem, out_certificate_errors, error);
ae7d88
 
ae7d88
 	e_async_closure_free (closure);
ae7d88
 
ae7d88
@@ -3236,11 +3336,11 @@ e_ews_autodiscover_ws_url (ESource *sour
ae7d88
 		simple, ad, (GDestroyNotify) autodiscover_data_free);
ae7d88
 
ae7d88
 	/* Passing a NULL URL string returns NULL. */
ae7d88
-	ad->msgs[0] = e_ews_get_msg_for_url (settings, url1, buf, &error);
ae7d88
-	ad->msgs[1] = e_ews_get_msg_for_url (settings, url2, buf, NULL);
ae7d88
-	ad->msgs[2] = e_ews_get_msg_for_url (settings, url3, buf, NULL);
ae7d88
-	ad->msgs[3] = e_ews_get_msg_for_url (settings, url4, buf, NULL);
ae7d88
-	ad->msgs[4] = e_ews_get_msg_for_url (settings, url5, buf, NULL);
ae7d88
+	ad->msgs[0] = e_ews_get_msg_for_url (cnc, settings, url1, buf, &error);
ae7d88
+	ad->msgs[1] = e_ews_get_msg_for_url (cnc, settings, url2, buf, NULL);
ae7d88
+	ad->msgs[2] = e_ews_get_msg_for_url (cnc, settings, url3, buf, NULL);
ae7d88
+	ad->msgs[3] = e_ews_get_msg_for_url (cnc, settings, url4, buf, NULL);
ae7d88
+	ad->msgs[4] = e_ews_get_msg_for_url (cnc, settings, url5, buf, NULL);
ae7d88
 
ae7d88
 	/* These have to be submitted only after they're both set in ad->msgs[]
ae7d88
 	 * or there will be races with fast completion */
ae7d88
@@ -3300,10 +3400,13 @@ has_suffix_icmp (const gchar *text,
ae7d88
 gboolean
ae7d88
 e_ews_autodiscover_ws_url_finish (CamelEwsSettings *settings,
ae7d88
                                   GAsyncResult *result,
ae7d88
+				  gchar **out_certificate_pem,
ae7d88
+				  GTlsCertificateFlags *out_certificate_errors,
ae7d88
                                   GError **error)
ae7d88
 {
ae7d88
 	GSimpleAsyncResult *simple;
ae7d88
 	struct _autodiscover_data *ad;
ae7d88
+	GError *local_error = NULL;
ae7d88
 
ae7d88
 	g_return_val_if_fail (
ae7d88
 		g_simple_async_result_is_valid (
ae7d88
@@ -3313,8 +3416,20 @@ e_ews_autodiscover_ws_url_finish (CamelE
ae7d88
 	simple = G_SIMPLE_ASYNC_RESULT (result);
ae7d88
 	ad = g_simple_async_result_get_op_res_gpointer (simple);
ae7d88
 
ae7d88
-	if (g_simple_async_result_propagate_error (simple, error))
ae7d88
+	if (g_simple_async_result_propagate_error (simple, &local_error)) {
ae7d88
+		if (g_error_matches (local_error, SOUP_HTTP_ERROR, SOUP_STATUS_SSL_FAILED)) {
ae7d88
+			if (!e_ews_connection_get_ssl_error_details (ad->cnc, out_certificate_pem, out_certificate_errors)) {
ae7d88
+				if (out_certificate_pem)
ae7d88
+					*out_certificate_pem = NULL;
ae7d88
+				if (out_certificate_errors)
ae7d88
+					*out_certificate_errors = 0;
ae7d88
+			}
ae7d88
+		}
ae7d88
+
ae7d88
+		g_propagate_error (error, local_error);
ae7d88
+
ae7d88
 		return FALSE;
ae7d88
+	}
ae7d88
 
ae7d88
 	g_warn_if_fail (ad->as_url != NULL);
ae7d88
 	g_warn_if_fail (ad->oab_url != NULL);
ae7d88
@@ -3473,6 +3588,8 @@ oal_response_cb (SoupSession *soup_sessi
ae7d88
 	simple = G_SIMPLE_ASYNC_RESULT (user_data);
ae7d88
 	data = g_simple_async_result_get_op_res_gpointer (simple);
ae7d88
 
ae7d88
+	ews_connection_check_ssl_error (data->cnc, soup_message);
ae7d88
+
ae7d88
 	if (ews_connection_credentials_failed (data->cnc, soup_message, simple)) {
ae7d88
 		goto exit;
ae7d88
 	} else if (soup_message->status_code != 200) {
ae7d88
@@ -3618,7 +3735,7 @@ e_ews_connection_get_oal_list (EEwsConne
ae7d88
 
ae7d88
 	g_return_if_fail (E_IS_EWS_CONNECTION (cnc));
ae7d88
 
ae7d88
-	soup_message = e_ews_get_msg_for_url (cnc->priv->settings, cnc->priv->uri, NULL, &error);
ae7d88
+	soup_message = e_ews_get_msg_for_url (cnc, cnc->priv->settings, cnc->priv->uri, NULL, &error);
ae7d88
 
ae7d88
 	simple = g_simple_async_result_new (
ae7d88
 		G_OBJECT (cnc), callback, user_data,
ae7d88
@@ -3739,7 +3856,7 @@ e_ews_connection_get_oal_detail (EEwsCon
ae7d88
 
ae7d88
 	g_return_if_fail (E_IS_EWS_CONNECTION (cnc));
ae7d88
 
ae7d88
-	soup_message = e_ews_get_msg_for_url (cnc->priv->settings, cnc->priv->uri, NULL, &error);
ae7d88
+	soup_message = e_ews_get_msg_for_url (cnc, cnc->priv->settings, cnc->priv->uri, NULL, &error);
ae7d88
 
ae7d88
 	simple = g_simple_async_result_new (
ae7d88
 		G_OBJECT (cnc), callback, user_data,
ae7d88
@@ -3826,6 +3943,8 @@ oal_download_response_cb (SoupSession *s
ae7d88
 	simple = G_SIMPLE_ASYNC_RESULT (user_data);
ae7d88
 	data = g_simple_async_result_get_op_res_gpointer (simple);
ae7d88
 
ae7d88
+	ews_connection_check_ssl_error (data->cnc, soup_message);
ae7d88
+
ae7d88
 	if (ews_connection_credentials_failed (data->cnc, soup_message, simple)) {
ae7d88
 		g_unlink (data->cache_filename);
ae7d88
 	} else if (soup_message->status_code != 200) {
ae7d88
@@ -3954,7 +4073,7 @@ e_ews_connection_download_oal_file (EEws
ae7d88
 
ae7d88
 	g_return_if_fail (E_IS_EWS_CONNECTION (cnc));
ae7d88
 
ae7d88
-	soup_message = e_ews_get_msg_for_url (cnc->priv->settings, cnc->priv->uri, NULL, &error);
ae7d88
+	soup_message = e_ews_get_msg_for_url (cnc, cnc->priv->settings, cnc->priv->uri, NULL, &error);
ae7d88
 
ae7d88
 	simple = g_simple_async_result_new (
ae7d88
 		G_OBJECT (cnc), callback, user_data,
ae7d88
diff -up evolution-ews-3.28.5/src/server/e-ews-connection.h.cve-2019-3890 evolution-ews-3.28.5/src/server/e-ews-connection.h
ae7d88
--- evolution-ews-3.28.5/src/server/e-ews-connection.h.cve-2019-3890	2018-07-30 16:01:00.000000000 +0200
ae7d88
+++ evolution-ews-3.28.5/src/server/e-ews-connection.h	2019-04-15 09:43:49.689771516 +0200
ae7d88
@@ -426,9 +426,16 @@ ESourceAuthenticationResult
ae7d88
 		e_ews_connection_try_credentials_sync
ae7d88
 						(EEwsConnection *cnc,
ae7d88
 						 const ENamedParameters *credentials,
ae7d88
+						 ESource *use_source,
ae7d88
+						 gchar **out_certificate_pem,
ae7d88
+						 GTlsCertificateFlags *out_certificate_errors,
ae7d88
 						 GCancellable *cancellable,
ae7d88
 						 GError **error);
ae7d88
 ESource *	e_ews_connection_get_source	(EEwsConnection *cnc);
ae7d88
+gboolean	e_ews_connection_get_ssl_error_details
ae7d88
+						(EEwsConnection *cnc,
ae7d88
+						 gchar **out_certificate_pem,
ae7d88
+						 GTlsCertificateFlags *out_certificate_errors);
ae7d88
 const gchar *	e_ews_connection_get_uri	(EEwsConnection *cnc);
ae7d88
 ESoupAuthBearer *
ae7d88
 		e_ews_connection_ref_bearer_auth(EEwsConnection *cnc);
ae7d88
@@ -469,6 +476,8 @@ gboolean	e_ews_autodiscover_ws_url_sync
ae7d88
 						 CamelEwsSettings *settings,
ae7d88
 						 const gchar *email_address,
ae7d88
 						 const gchar *password,
ae7d88
+						 gchar **out_certificate_pem,
ae7d88
+						 GTlsCertificateFlags *out_certificate_errors,
ae7d88
 						 GCancellable *cancellable,
ae7d88
 						 GError **error);
ae7d88
 void		e_ews_autodiscover_ws_url	(ESource *source,
ae7d88
@@ -481,6 +490,8 @@ void		e_ews_autodiscover_ws_url	(ESource
ae7d88
 gboolean	e_ews_autodiscover_ws_url_finish
ae7d88
 						(CamelEwsSettings *settings,
ae7d88
 						 GAsyncResult *result,
ae7d88
+						 gchar **out_certificate_pem,
ae7d88
+						 GTlsCertificateFlags *out_certificate_errors,
ae7d88
 						 GError **error);
ae7d88
 const gchar *	e_ews_connection_get_mailbox	(EEwsConnection *cnc);
ae7d88
 void		e_ews_connection_set_mailbox	(EEwsConnection *cnc,
ae7d88
diff -up evolution-ews-3.28.5/src/server/e-ews-connection-utils.c.cve-2019-3890 evolution-ews-3.28.5/src/server/e-ews-connection-utils.c
ae7d88
--- evolution-ews-3.28.5/src/server/e-ews-connection-utils.c.cve-2019-3890	2018-07-30 16:01:00.000000000 +0200
ae7d88
+++ evolution-ews-3.28.5/src/server/e-ews-connection-utils.c	2019-04-15 09:43:49.690771516 +0200
ae7d88
@@ -522,8 +522,13 @@ e_ews_connection_utils_prepare_message (
ae7d88
 					GCancellable *cancellable)
ae7d88
 {
ae7d88
 	ESoupAuthBearer *using_bearer_auth;
ae7d88
+	ESource *source;
ae7d88
 	GError *local_error = NULL;
ae7d88
 
ae7d88
+	source = e_ews_connection_get_source (cnc);
ae7d88
+	if (source)
ae7d88
+		e_soup_ssl_trust_connect (message, source);
ae7d88
+
ae7d88
 	if (!ews_connection_utils_maybe_prepare_bearer_auth (cnc, message, cancellable))
ae7d88
 		return FALSE;
ae7d88