ALT-PU-2025-7373-2
Closed vulnerabilities
Published: 2022-06-10
BDU:2023-03850
Уязвимость функции write_status_text_and_buffer компонента cpr.c программы для шифрования информации и создания электронных цифровых подписей GnuPG, позволяющая нарушителю получить доступ к конфиденциальным данным и нарушить их целостность
Severity: MEDIUM (6.5)
Vector: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Severity: HIGH (7.8)
Vector: AV:N/AC:M/Au:N/C:C/I:P/A:N
References:
Published: 2022-07-01
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2022-34903
GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line.
Severity: MEDIUM (5.8)
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Severity: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
References:
- http://www.openwall.com/lists/oss-security/2022/07/02/1
- https://bugs.debian.org/1014157
- https://dev.gnupg.org/T6027
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRLWJQ76A4UKHI3Q36BKSJKS4LFLQO33/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPTAR76EIZY7NQFENSOZO7U473257OVZ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VN63GBTMRWO36Y7BKA2WQHROAKCXKCBL/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU64FUVG2PRZBSHFOQRSP7KDVEIZ23OS/
- https://security.netapp.com/advisory/ntap-20220826-0005/
- https://www.debian.org/security/2022/dsa-5174
- https://www.openwall.com/lists/oss-security/2022/06/30/1
- http://www.openwall.com/lists/oss-security/2022/07/02/1
- https://bugs.debian.org/1014157
- https://dev.gnupg.org/T6027
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRLWJQ76A4UKHI3Q36BKSJKS4LFLQO33/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPTAR76EIZY7NQFENSOZO7U473257OVZ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VN63GBTMRWO36Y7BKA2WQHROAKCXKCBL/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU64FUVG2PRZBSHFOQRSP7KDVEIZ23OS/
- https://security.netapp.com/advisory/ntap-20220826-0005/
- https://www.debian.org/security/2022/dsa-5174
- https://www.openwall.com/lists/oss-security/2022/06/30/1
Closed bugs
Скрипты для запуска gpg-agent устарели
Обновить gnupg2
gnupg2: restore setting GPG_TTY in profile.d