ISOMAN

CVE

CVE-2019-6690

python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting the affect functionality component.

Severity
HIGH
CVSS
7.5
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu18.04.6 amd64 desktopunknownsource
Ubuntu18.04.6 amd64 live-serverunknownsource

References

  1. http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00008.html
  2. http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00058.html
  3. http://packetstormsecurity.com/files/151341/Python-GnuPG-0.4.3-Improper-Input-Validation.html
  4. http://www.securityfocus.com/bid/106756
  5. https://blog.hackeriet.no/cve-2019-6690-python-gnupg-vulnerability/
  6. https://lists.debian.org/debian-lts-announce/2019/02/msg00021.html
  7. https://lists.debian.org/debian-lts-announce/2021/12/msg00027.html
  8. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WMV6XNPPL3VB3RQRFFOBCJ3AGWC4K47/
  9. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6KYZMN2PWXY4ENZVJUVTGFBVYEVY7II/
  10. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4VFRUG56542LTYK4444TPJBGR57MT25/
  11. https://pypi.org/project/python-gnupg/#history
  12. https://seclists.org/bugtraq/2019/Jan/41
  13. https://usn.ubuntu.com/3964-1/
  14. http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00008.html
  15. http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00058.html
  16. http://packetstormsecurity.com/files/151341/Python-GnuPG-0.4.3-Improper-Input-Validation.html
  17. http://www.securityfocus.com/bid/106756
  18. https://blog.hackeriet.no/cve-2019-6690-python-gnupg-vulnerability/
  19. https://lists.debian.org/debian-lts-announce/2019/02/msg00021.html
  20. https://lists.debian.org/debian-lts-announce/2021/12/msg00027.html