Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-6690

python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting the affect functionality component.

Published

2019-03-21T16:01:09.077

Last Modified

2024-11-21T04:46:57.777

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-20
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application python python-gnupg 0.4.3 Yes
Operating System debian debian_linux 8.0 Yes
Operating System debian debian_linux 9.0 Yes
Operating System opensuse leap 15.0 Yes
Application suse backports - Yes
Operating System suse linux_enterprise 15.0 No
Operating System canonical ubuntu_linux 18.04 Yes
Operating System canonical ubuntu_linux 18.10 Yes
Operating System canonical ubuntu_linux 19.04 Yes
References