All errata/sisyphus/ALT-PU-2018-2427-1
ALT-PU-2018-2427-1

Package update gnupg2 in branch sisyphus

Version2.2.10-alt2
Task#214019
Published2018-10-08
Max severityHIGH
Severity:

Closed issues (2)

BDU:2019-00237
HIGH7.5

Уязвимость процесса mainproc.c программы шифрования информации и создания электронных цифровых подписей GNU Privacy Guard, позволяющая нарушителю оказать воздействие на целостность защищаемой информации

Published: 2019-01-23Modified: 2025-08-27
CVSS 3.xHIGH 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:C/A:N
References
CVE-2018-12020
HIGH7.5

mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.

Published: 2018-06-08Modified: 2024-11-21
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References

Closed bugs (1)