CVE-2019-6690

HIGH7.5EPSS 21.4%

Improper Input Validation python-gnupg

Published: 3/25/2019Modified: 2/22/2024

Also known as:GHSA-2fch-jvg5-crf6 GHSA-qh62-ch95-63whDEBIAN-CVE-2019-6690PYSEC-2019-115

Description

python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting the affect functionality component.

Affected packages (5)

Debian/python-gnupgfrom 0, < 0.4.4-1
Debian/python-gnupgfrom 0, < 0.3.6-1+deb8u1
PyPI/python-gnupgfrom 0, < 0.4.4
PyPI/python-gnupgfrom 0, < 0.4.4
PyPI/python-gnupgfrom 0, < 0.4.4

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References (25)

ADVISORYhttps://blog.hackeriet.no/cve-2019-6690-python-gnupg-vulnerability/
ADVISORYhttps://github.com/advisories/GHSA-2fch-jvg5-crf6
ADVISORYhttps://github.com/advisories/GHSA-qh62-ch95-63wh
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2019-6690
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2019-6690
WEBhttp://lists.opensuse.org/opensuse-security-announce/2019-02/msg00008.html
WEBhttp://lists.opensuse.org/opensuse-security-announce/2019-02/msg00058.html
WEBhttp://packetstormsecurity.com/files/151341/Python-GnuPG-0.4.3-Improper-Input-Validation.html
WEBhttps://bitbucket.org/vinay.sajip/python-gnupg/commits/1a5196800604c05f9e347110b4ecca538ba68cdc
WEBhttps://blog.hackeriet.no/cve-2019-6690-python-gnupg-vulnerability
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/python-gnupg/PYSEC-2019-115.yaml
WEBhttps://lists.debian.org/debian-lts-announce/2019/02/msg00021.html
WEBhttps://lists.debian.org/debian-lts-announce/2021/12/msg00027.html
WEBhttps://lists.fedoraproject.org/archives/list/[email protected]/message/3WMV6XNPPL3VB3RQRFFOBCJ3AGWC4K47
WEBhttps://lists.fedoraproject.org/archives/list/[email protected]/message/3WMV6XNPPL3VB3RQRFFOBCJ3AGWC4K47/
WEBhttps://lists.fedoraproject.org/archives/list/[email protected]/message/W6KYZMN2PWXY4ENZVJUVTGFBVYEVY7II
WEBhttps://lists.fedoraproject.org/archives/list/[email protected]/message/W6KYZMN2PWXY4ENZVJUVTGFBVYEVY7II/
WEBhttps://lists.fedoraproject.org/archives/list/[email protected]/message/X4VFRUG56542LTYK4444TPJBGR57MT25
WEBhttps://lists.fedoraproject.org/archives/list/[email protected]/message/X4VFRUG56542LTYK4444TPJBGR57MT25/
WEBhttps://pypi.org/project/python-gnupg/#history
WEBhttps://seclists.org/bugtraq/2019/Jan/41
WEBhttps://usn.ubuntu.com/3964-1
WEBhttps://usn.ubuntu.com/3964-1/
WEBhttps://web.archive.org/web/20200227091727/http://www.securityfocus.com/bid/106756
WEBhttp://www.securityfocus.com/bid/106756