GHSA-2fch-jvg5-crf6

Source

https://github.com/advisories/GHSA-2fch-jvg5-crf6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/03/GHSA-2fch-jvg5-crf6/GHSA-2fch-jvg5-crf6.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-2fch-jvg5-crf6

Aliases

Published

2019-03-25T16:17:53Z

Modified

2024-02-22T05:29:12.425272Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

Improper Input Validation python-gnupg

Details

python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting the affect functionality component.

Database specific

{
    "nvd_published_at": "2019-03-21T16:01:00Z",
    "cwe_ids": [
        "CWE-20"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T20:41:57Z"
}

References

Affected packages

PyPI / python-gnupg

Package

Name: python-gnupg; View open source insights on deps.dev
Purl: pkg:pypi/python-gnupg

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.4.4

Affected versions

0.*

0.2.3

0.2.4

0.2.6

0.2.7

0.2.8

0.2.9

0.3.0

0.3.1

0.3.2

0.3.3

0.3.4

0.3.5

0.3.6

0.3.7

0.3.8

0.3.9

0.4.0

0.4.1

0.4.2

0.4.3