DEBIAN-CVE-2013-4351

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2013-4351
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2013-4351.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2013-4351
Upstream
Published
2013-10-10T00:55:15Z
Modified
2025-09-19T06:22:30Z
Summary
[none]
Details

GnuPG 1.4.x, 2.0.x, and 2.1.x treats a key flags subpacket with all bits cleared (no usage permitted) as if it has all bits set (all usage permitted), which might allow remote attackers to bypass intended cryptographic protection mechanisms by leveraging the subkey.

References

Affected packages

Debian:11 / gnupg2

Package

Name
gnupg2
Purl
pkg:deb/debian/gnupg2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.0.22-1

Ecosystem specific 

{
    "urgency": "low"
}

Debian:12 / gnupg2

Package

Name
gnupg2
Purl
pkg:deb/debian/gnupg2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.0.22-1

Ecosystem specific 

{
    "urgency": "low"
}

Debian:13 / gnupg2

Package

Name
gnupg2
Purl
pkg:deb/debian/gnupg2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.0.22-1

Ecosystem specific 

{
    "urgency": "low"
}

Debian:14 / gnupg2

Package

Name
gnupg2
Purl
pkg:deb/debian/gnupg2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.0.22-1

Ecosystem specific 

{
    "urgency": "low"
}