CVE search · CVE-2019-6690
CVE-2019-6690
high 7.5
python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting the affect functionality component.
Details
- Status
- Modified
- Published
- Last changed
- Source
- cve@mitre.org
- Weakness
- CWE-20
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | high 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
nvd@nist.govPrimary |
| CVSS 2.0 | medium 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- python · python-gnupg
- debian · debian_linux
- opensuse · leap
- suse · backports
- canonical · ubuntu_linux
References
- http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00008.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00058.htmlMailing ListThird Party Advisory
- http://packetstormsecurity.com/files/151341/Python-GnuPG-0.4.3-Improper-Input-Validation.htmlThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/106756Broken Link
- https://blog.hackeriet.no/cve-2019-6690-python-gnupg-vulnerability/Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/02/msg00021.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/12/msg00027.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WMV6XNPPL3VB3RQRFFOBCJ3AGWC4K47/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6KYZMN2PWXY4ENZVJUVTGFBVYEVY7II/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4VFRUG56542LTYK4444TPJBGR57MT25/
- https://pypi.org/project/python-gnupg/#historyProductThird Party Advisory
- https://seclists.org/bugtraq/2019/Jan/41Mailing ListThird Party Advisory
- https://usn.ubuntu.com/3964-1/Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00008.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00058.htmlMailing ListThird Party Advisory
- http://packetstormsecurity.com/files/151341/Python-GnuPG-0.4.3-Improper-Input-Validation.htmlThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/106756Broken Link
- https://blog.hackeriet.no/cve-2019-6690-python-gnupg-vulnerability/Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/02/msg00021.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/12/msg00027.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WMV6XNPPL3VB3RQRFFOBCJ3AGWC4K47/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6KYZMN2PWXY4ENZVJUVTGFBVYEVY7II/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4VFRUG56542LTYK4444TPJBGR57MT25/
- https://pypi.org/project/python-gnupg/#historyProductThird Party Advisory
- https://seclists.org/bugtraq/2019/Jan/41Mailing ListThird Party Advisory
- https://usn.ubuntu.com/3964-1/Third Party Advisory