7.5

CVE-2018-12020

mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Canonical ≫ Ubuntu Linux Version 12.04 SwEdition esm
Canonical ≫ Ubuntu Linux Version 14.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 16.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 17.10
Canonical ≫ Ubuntu Linux Version 18.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 18.10
Canonical ≫ Ubuntu Linux Version 19.04
Debian ≫ Debian Linux Version 8.0
Debian ≫ Debian Linux Version 9.0
Gnupg ≫ Gnupg Version < 2.2.8
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 8.55% 0.946
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:P/A:N
CWE-706 Use of Incorrectly-Resolved Name or Reference

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0
Third Party Advisory
http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2019/Apr/38
Third Party Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2019/04/30/4
Third Party Advisory
Mailing List
https://github.com/RUB-NDS/Johnny-You-Are-Fired
Third Party Advisory
Technical Description
https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf
Third Party Advisory
Technical Description
https://usn.ubuntu.com/3675-1/
Third Party Advisory
http://openwall.com/lists/oss-security/2018/06/08/2
Third Party Advisory
Mailing List
http://www.securityfocus.com/bid/104450
Broken Link
http://www.securitytracker.com/id/1041051
Broken Link
https://access.redhat.com/errata/RHSA-2018:2180
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2181
Third Party Advisory
https://dev.gnupg.org/T4012
Patch
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00027.html
Third Party Advisory
Mailing List
https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html
Vendor Advisory
Mailing List
https://usn.ubuntu.com/3675-2/
Third Party Advisory
https://usn.ubuntu.com/3675-3/
Third Party Advisory
https://usn.ubuntu.com/3964-1/
Third Party Advisory
https://www.debian.org/security/2018/dsa-4222
Third Party Advisory
https://www.debian.org/security/2018/dsa-4223
Third Party Advisory
https://www.debian.org/security/2018/dsa-4224
Third Party Advisory