CVE-2018-9234
High
Description
GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey.
SeverityHigh
CVSS7.5
Exploit probability—
ProductGnupg
PublishedApr 4, 2018
First seenApr 4, 2018
How to fix
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gnupg gnupg | 2.2.4, 2.2.5 | — |
| canonical ubuntu_linux | 14.04, 16.04, 17.10, 18.04 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.