Описание
Security update for gpg2
This update for gpg2 fixes the following issue:
Security issue fixed:
- CVE-2018-1000858: Fixed a Cross Site Request Forgery(CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF (bsc#1120346).
This update was imported from the SUSE:SLE-15:Update update project.
Список пакетов
openSUSE Leap 15.0
gpg2-2.2.5-lp150.3.6.1
gpg2-lang-2.2.5-lp150.3.6.1
Ссылки
- E-Mail link for openSUSE-SU-2019:0020-1
- SUSE Security Ratings
- SUSE Bug 1120346
- SUSE CVE CVE-2018-1000858 page
Описание
GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Disclosure, DoS. This attack appear to be exploitable via Victim must perform a WKD request, e.g. enter an email address in the composer window of Thunderbird/Enigmail. This vulnerability appears to have been fixed in after commit 4a4bb874f63741026bd26264c43bb32b1099f060.
Затронутые продукты
openSUSE Leap 15.0:gpg2-2.2.5-lp150.3.6.1
openSUSE Leap 15.0:gpg2-lang-2.2.5-lp150.3.6.1
Ссылки
- CVE-2018-1000858
- SUSE Bug 1120346