7.5

CVE-2018-12020

mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Canonical ≫ Ubuntu Linux Version12.04 SwEditionesm
Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version17.10
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version18.10
Canonical ≫ Ubuntu Linux Version19.04
Debian ≫ Debian Linux Version8.0
Debian ≫ Debian Linux Version9.0
Gnupg ≫ Gnupg Version < 2.2.8
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 8.65% 0.944
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:P/A:N
CWE-706 Use of Incorrectly-Resolved Name or Reference

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0
Third Party Advisory
http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2019/Apr/38
Third Party Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2019/04/30/4
Third Party Advisory
Mailing List
https://github.com/RUB-NDS/Johnny-You-Are-Fired
Third Party Advisory
Technical Description
https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf
Third Party Advisory
Technical Description
https://usn.ubuntu.com/3675-1/
Third Party Advisory
http://openwall.com/lists/oss-security/2018/06/08/2
Third Party Advisory
Mailing List
http://www.securityfocus.com/bid/104450
Broken Link
http://www.securitytracker.com/id/1041051
Broken Link
https://access.redhat.com/errata/RHSA-2018:2180
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2181
Third Party Advisory
https://dev.gnupg.org/T4012
Patch
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00027.html
Third Party Advisory
Mailing List
https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html
Vendor Advisory
Mailing List
https://usn.ubuntu.com/3675-2/
Third Party Advisory
https://usn.ubuntu.com/3675-3/
Third Party Advisory
https://usn.ubuntu.com/3964-1/
Third Party Advisory
https://www.debian.org/security/2018/dsa-4222
Third Party Advisory
https://www.debian.org/security/2018/dsa-4223
Third Party Advisory
https://www.debian.org/security/2018/dsa-4224
Third Party Advisory