CVE-2019-6690

Опубликовано: 21 мар. 2019

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Средний

Описание

python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting the affect functionality component.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00008.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00058.html
Mailing List
Third Party Advisory
http://packetstormsecurity.com/files/151341/Python-GnuPG-0.4.3-Improper-Input-Validation.html
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/106756
Broken Link
https://blog.hackeriet.no/cve-2019-6690-python-gnupg-vulnerability/
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/02/msg00021.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00027.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WMV6XNPPL3VB3RQRFFOBCJ3AGWC4K47/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6KYZMN2PWXY4ENZVJUVTGFBVYEVY7II/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4VFRUG56542LTYK4444TPJBGR57MT25/
https://pypi.org/project/python-gnupg/#history
Product
Third Party Advisory
https://seclists.org/bugtraq/2019/Jan/41
Mailing List
Third Party Advisory
https://usn.ubuntu.com/3964-1/
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00008.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00058.html
Mailing List
Third Party Advisory
http://packetstormsecurity.com/files/151341/Python-GnuPG-0.4.3-Improper-Input-Validation.html
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/106756
Broken Link
https://blog.hackeriet.no/cve-2019-6690-python-gnupg-vulnerability/
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/02/msg00021.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00027.html
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:python:python-gnupg:0.4.3:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

cpe:2.3:a:suse:backports:-:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise:15.0:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*

EPSS

Процентиль: 96%

0.22008

Средний

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-20

Связанные уязвимости

CVE-2019-6690

CVSS3: 7.5

ubuntu

больше 6 лет назад

CVE-2019-6690

CVSS3: 7.5

redhat

больше 6 лет назад

CVE-2019-6690

CVSS3: 7.5

debian

больше 6 лет назад

python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg t ...

openSUSE-SU-2019:0143-1

suse-cvrf

больше 6 лет назад

Security update for python-python-gnupg

GHSA-2fch-jvg5-crf6

CVSS3: 7.5

github

больше 6 лет назад

Improper Input Validation python-gnupg

EPSS

Процентиль: 96%

0.22008

Средний

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-20