CVE-2019-6690
High
Description
python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting the affect functionality component.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Python-gnupg
PublishedMar 21, 2019
First seenMar 21, 2019
How to fix
Update
- python-gnupg0.4.4 or later
Vendor advisories
- usn.ubuntu.com/3964-1/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6KYZMN2PWXY4ENZVJUVTGFBVYEVY7II/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4VFRUG56542LTYK4444TPJBGR57MT25/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WMV6XNPPL3VB3RQRFFOBCJ3AGWC4K47/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| python python-gnupg | 0.4.3 | — |
| debian debian_linux | 8.0, 9.0 | — |
| opensuse leap | 15.0 | — |
| suse backports | No range specified | — |
| canonical ubuntu_linux | 18.04, 18.10, 19.04 | — |
| python-gnupgPyPI | v < 0.4.4 | 0.4.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.