Gnupg Gnupg

Do you want an email whenever new security vulnerabilities are reported in Gnupg?

By the Year

In 2022 there have been 1 vulnerability in Gnupg with an average score of 6.5 out of ten. Gnupg did not have any published security vulnerabilities last year. That is, 1 more vulnerability have already been reported in 2022 as compared to last year.

Year Vulnerabilities Average Score
2022 1 6.50
2021 0 0.00
2020 1 7.50
2019 1 7.50
2018 3 7.93

It may take a day or so for new Gnupg vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Gnupg Security Vulnerabilities

GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information

CVE-2022-34903 6.5 - Medium - July 01, 2022

GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line.

Injection

A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm

CVE-2019-14855 7.5 - High - March 20, 2020

A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.

Inadequate Encryption Strength

Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network

CVE-2019-13050 7.5 - High - June 29, 2019

Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.

Improper Certificate Validation

GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr

CVE-2018-1000858 8.8 - High - December 20, 2018

GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Disclosure, DoS. This attack appear to be exploitable via Victim must perform a WKD request, e.g. enter an email address in the composer window of Thunderbird/Enigmail. This vulnerability appears to have been fixed in after commit 4a4bb874f63741026bd26264c43bb32b1099f060.

Session Riding

mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output

CVE-2018-12020 7.5 - High - June 08, 2018

mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.

Use of Incorrectly-Resolved Name or Reference

GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications

CVE-2018-9234 7.5 - High - April 04, 2018

GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey.

Key Management Errors

Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG

CVE-2014-9087 - December 01, 2014

Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of service (crash) via a crafted OID in a (1) S/MIME message or (2) ECC based OpenPGP data, which triggers a buffer overflow.

Integer underflow

Stay on top of Security Vulnerabilities

Want an email whenever new vulnerabilities are published for Mageia or by Gnupg? Click the Watch button to subscribe.

Gnupg
Vendor

Gnupg
Product

subscribe