7.5

CVE-2018-12020

mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Canonical ≫ Ubuntu Linux Version12.04 SwEditionesm
Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version17.10
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version18.10
Canonical ≫ Ubuntu Linux Version19.04
Debian ≫ Debian Linux Version8.0
Debian ≫ Debian Linux Version9.0
Gnupg ≫ Gnupg Version < 2.2.8
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.56% 0.809
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:P/A:N
CWE-706 Use of Incorrectly-Resolved Name or Reference

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

http://seclists.org/fulldisclosure/2019/Apr/38
Third Party Advisory
Mailing List
https://github.com/RUB-NDS/Johnny-You-Are-Fired
Third Party Advisory
Technical Description
https://usn.ubuntu.com/3675-1/
Third Party Advisory
http://openwall.com/lists/oss-security/2018/06/08/2
Third Party Advisory
Mailing List
https://dev.gnupg.org/T4012
Patch
Vendor Advisory
https://usn.ubuntu.com/3675-2/
Third Party Advisory
https://usn.ubuntu.com/3675-3/
Third Party Advisory
https://usn.ubuntu.com/3964-1/
Third Party Advisory