Gnupg
By the Year
In 2022 there have been 1 vulnerability in Gnupg with an average score of 6.5 out of ten. Gnupg did not have any published security vulnerabilities last year. That is, 1 more vulnerability have already been reported in 2022 as compared to last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2022 | 1 | 6.50 |
| 2021 | 0 | 0.00 |
| 2020 | 1 | 7.50 |
| 2019 | 1 | 7.50 |
| 2018 | 3 | 7.93 |
It may take a day or so for new Gnupg vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Gnupg Security Vulnerabilities
GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information
CVE-2022-34903
6.5 - Medium
- July 01, 2022
GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line.
Injection
A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm
CVE-2019-14855
7.5 - High
- March 20, 2020
A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.
Inadequate Encryption Strength
Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network
CVE-2019-13050
7.5 - High
- June 29, 2019
Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.
Improper Certificate Validation
GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr
CVE-2018-1000858
8.8 - High
- December 20, 2018
GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Disclosure, DoS. This attack appear to be exploitable via Victim must perform a WKD request, e.g. enter an email address in the composer window of Thunderbird/Enigmail. This vulnerability appears to have been fixed in after commit 4a4bb874f63741026bd26264c43bb32b1099f060.
Session Riding
mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output
CVE-2018-12020
7.5 - High
- June 08, 2018
mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.
Use of Incorrectly-Resolved Name or Reference
GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications
CVE-2018-9234
7.5 - High
- April 04, 2018
GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey.
Key Management Errors
Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG
CVE-2014-9087
- December 01, 2014
Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of service (crash) via a crafted OID in a (1) S/MIME message or (2) ECC based OpenPGP data, which triggers a buffer overflow.
Integer underflow
