CVE-2020-24972

Опубликовано: 29 авг. 2020

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Средний

Описание

The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00053.html
Broken Link
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00064.html
Broken Link
Mailing List
Third Party Advisory
https://dev.gnupg.org/rKLEOPATRAb4bd63c1739900d94c04da03045e9445a5a5f54b
Patch
Vendor Advisory
https://dev.gnupg.org/source/kleo/browse/master/CMakeLists.txt
Exploit
Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IRIPL72WMXTVWS2M7WYV5SNPETYJ2YI7/
https://security.gentoo.org/glsa/202008-21
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00053.html
Broken Link
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00064.html
Broken Link
Mailing List
Third Party Advisory
https://dev.gnupg.org/rKLEOPATRAb4bd63c1739900d94c04da03045e9445a5a5f54b
Patch
Vendor Advisory
https://dev.gnupg.org/source/kleo/browse/master/CMakeLists.txt
Exploit
Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IRIPL72WMXTVWS2M7WYV5SNPETYJ2YI7/
https://security.gentoo.org/glsa/202008-21
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:kleopatra_project:kleopatra:*:*:*:*:*:gnupg:*:*

Версия до 20.07.80 (исключая)

Конфигурация 2

cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

EPSS

Процентиль: 96%

0.21343

Средний

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-116

Связанные уязвимости

CVE-2020-24972

CVSS3: 8.8

ubuntu

больше 5 лет назад

CVE-2020-24972

CVSS3: 8.8

debian

больше 5 лет назад

The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG ...

openSUSE-SU-2020:1723-1

suse-cvrf

больше 5 лет назад

Security update for kleopatra

GHSA-p3w5-fpg6-wrh9

CVSS3: 8.8

github

больше 3 лет назад

EPSS

Процентиль: 96%

0.21343

Средний

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-116