Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner

Sources

Sort by

Order

Apply ordering (override relevance)

CVE-2026-57062 (GCVE-0-2026-57062)

Vulnerability from cvelistv5 – Published: 2026-06-23 17:26 – Updated: 2026-06-23 17:35

Summary

CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.

Severity

2.9 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-1284 - Improper Validation of Specified Quantity in Input

Assigner

mitre

References

2 references

URL	Tags
https://blog.calif.io/p/how-to-format-a-ciphertext
https://www.gnupg.org/download/

Impacted products

1 product

Vendor	Product	Version
GnuPG	GnuPG	Affected: 0 , ≤ 2.5.20 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-57062",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T17:35:24.722258Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T17:35:30.113Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "GnuPG",
          "vendor": "GnuPG",
          "versions": [
            {
              "lessThanOrEqual": "2.5.20",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gnupg:gnupg:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "2.5.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.9,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284 Improper Validation of Specified Quantity in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-23T17:26:25.133Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://blog.calif.io/p/how-to-format-a-ciphertext"
        },
        {
          "url": "https://www.gnupg.org/download/"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-57062",
    "datePublished": "2026-06-23T17:26:25.133Z",
    "dateReserved": "2026-06-23T17:26:24.801Z",
    "dateUpdated": "2026-06-23T17:35:30.113Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41990 (GCVE-0-2026-41990)

Vulnerability from cvelistv5 – Published: 2026-04-23 04:39 – Updated: 2026-04-23 16:22

Summary

Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.

Severity

4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-787 - Out-of-bounds Write

Assigner

mitre

References

3 references

URL	Tags
https://lists.gnupg.org/pipermail/gnupg-announce/…
https://www.openwall.com/lists/oss-security/2026/…
https://dev.gnupg.org/T8208

Impacted products

1 product

Vendor	Product	Version
gnupg	Libgcrypt	Affected: 1.12.0 , < 1.12.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41990",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-23T15:58:26.094245Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-23T16:22:42.096Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Libgcrypt",
          "vendor": "gnupg",
          "versions": [
            {
              "lessThan": "1.12.2",
              "status": "affected",
              "version": "1.12.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.12.2",
                  "versionStartIncluding": "1.12.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-23T05:10:55.346Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/04/21/1"
        },
        {
          "url": "https://dev.gnupg.org/T8208"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-41990",
    "datePublished": "2026-04-23T04:39:04.524Z",
    "dateReserved": "2026-04-23T04:39:04.114Z",
    "dateUpdated": "2026-04-23T16:22:42.096Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41989 (GCVE-0-2026-41989)

Vulnerability from cvelistv5 – Published: 2026-04-23 04:30 – Updated: 2026-04-23 16:22

Summary

Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.

Severity

6.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-787 - Out-of-bounds Write

Assigner

mitre

References

3 references

URL	Tags
https://lists.gnupg.org/pipermail/gnupg-announce/…
https://dev.gnupg.org/T8211
https://www.openwall.com/lists/oss-security/2026/…

Impacted products

1 product

Vendor	Product	Version
gnupg	Libgcrypt	Affected: 1.8.8 , < 1.10.4 (semver) Affected: 1.11.0 , < 1.11.3 (semver) Affected: 1.12.0 , < 1.12.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41989",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-23T15:58:58.277481Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-23T16:22:47.896Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Libgcrypt",
          "vendor": "gnupg",
          "versions": [
            {
              "lessThan": "1.10.4",
              "status": "affected",
              "version": "1.8.8",
              "versionType": "semver"
            },
            {
              "lessThan": "1.11.3",
              "status": "affected",
              "version": "1.11.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.12.2",
              "status": "affected",
              "version": "1.12.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.10.4",
                  "versionStartIncluding": "1.8.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.11.3",
                  "versionStartIncluding": "1.11.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.12.2",
                  "versionStartIncluding": "1.12.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-23T05:10:34.992Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html"
        },
        {
          "url": "https://dev.gnupg.org/T8211"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/04/21/1"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-41989",
    "datePublished": "2026-04-23T04:30:26.124Z",
    "dateReserved": "2026-04-23T04:30:25.690Z",
    "dateUpdated": "2026-04-23T16:22:47.896Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-24883 (GCVE-0-2026-24883)

Vulnerability from cvelistv5 – Published: 2026-01-27 18:43 – Updated: 2026-01-28 15:52

Summary

In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of service (application crash).

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-476 - NULL Pointer Dereference

Assigner

mitre

References

2 references

URL	Tags
https://www.openwall.com/lists/oss-security/2026/…
https://dev.gnupg.org/T8049

Impacted products

1 product

Vendor	Product	Version
GnuPG	GnuPG	Affected: 2.5.3 , < 2.5.17 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24883",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-27T20:02:25.525861Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-27T20:02:38.338Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GnuPG",
          "vendor": "GnuPG",
          "versions": [
            {
              "lessThan": "2.5.17",
              "status": "affected",
              "version": "2.5.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gnupg:gnupg:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.5.17",
                  "versionStartIncluding": "2.5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig-\u003edata[] set to a NULL value, leading to a denial of service (application crash)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-28T15:52:11.076Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/01/27/8"
        },
        {
          "url": "https://dev.gnupg.org/T8049"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-24883",
    "datePublished": "2026-01-27T18:43:18.883Z",
    "dateReserved": "2026-01-27T18:43:18.620Z",
    "dateUpdated": "2026-01-28T15:52:11.076Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-24882 (GCVE-0-2026-24882)

Vulnerability from cvelistv5 – Published: 2026-01-27 18:40 – Updated: 2026-01-28 15:45

Summary

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-121 - Stack-based Buffer Overflow

Assigner

mitre

References

2 references

URL	Tags
https://www.openwall.com/lists/oss-security/2026/…
https://dev.gnupg.org/T8045

Impacted products

1 product

Vendor	Product	Version
GnuPG	GnuPG	Affected: 0 , < 2.5.17 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24882",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-27T20:07:25.362188Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-27T20:07:38.876Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GnuPG",
          "vendor": "GnuPG",
          "versions": [
            {
              "lessThan": "2.5.17",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gnupg:gnupg:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121 Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-28T15:45:56.231Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/01/27/8"
        },
        {
          "url": "https://dev.gnupg.org/T8045"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-24882",
    "datePublished": "2026-01-27T18:40:18.166Z",
    "dateReserved": "2026-01-27T18:40:17.903Z",
    "dateUpdated": "2026-01-28T15:45:56.231Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-24881 (GCVE-0-2026-24881)

Vulnerability from cvelistv5 – Published: 2026-01-27 18:36 – Updated: 2026-01-27 20:08

Summary

In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This can easily be leveraged for denial of service; however, there is also memory corruption that could lead to remote code execution.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-121 - Stack-based Buffer Overflow

Assigner

mitre

References

2 references

URL	Tags
https://www.openwall.com/lists/oss-security/2026/…
https://dev.gnupg.org/T8044

Impacted products

1 product

Vendor	Product	Version
GnuPG	GnuPG	Affected: 2.5.13 , < 2.5.17 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24881",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-27T20:08:45.733664Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-27T20:08:54.449Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GnuPG",
          "vendor": "GnuPG",
          "versions": [
            {
              "lessThan": "2.5.17",
              "status": "affected",
              "version": "2.5.13",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gnupg:gnupg:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.5.17",
                  "versionStartIncluding": "2.5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This can easily be leveraged for denial of service; however, there is also memory corruption that could lead to remote code execution."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121 Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-27T18:52:54.994Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/01/27/8"
        },
        {
          "url": "https://dev.gnupg.org/T8044"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-24881",
    "datePublished": "2026-01-27T18:36:56.727Z",
    "dateReserved": "2026-01-27T18:36:56.490Z",
    "dateUpdated": "2026-01-27T20:08:54.449Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-68973 (GCVE-0-2025-68973)

Vulnerability from cvelistv5 – Published: 2025-12-28 16:19 – Updated: 2026-04-30 03:55

Summary

In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-675 - Multiple Operations on Resource in Single-Operation Context

Assigner

mitre

References

9 references

URL	Tags
https://gpg.fail/memcpy
https://news.ycombinator.com/item?id=46403200
https://www.openwall.com/lists/oss-security/2025/…
https://github.com/gpg/gnupg/commit/115d138ba5993…
https://github.com/gpg/gnupg/blob/ff30683418695f5…
https://github.com/gpg/gnupg/compare/gnupg-2.2.50…
https://media.ccc.de/v/39c3-to-sign-or-not-to-sig…
http://www.openwall.com/lists/oss-security/2025/1…
https://lists.debian.org/debian-lts-announce/2026…

Impacted products

1 product

Vendor	Product	Version
GnuPG	GnuPG	Affected: 0 , < 2.2.51 (semver) Affected: 2.3.0 , < 2.4.9 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-68973",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-29T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-30T03:55:53.604Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://gpg.fail/memcpy"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-14T19:04:33.329Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/12/29/11"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "GnuPG",
          "vendor": "GnuPG",
          "versions": [
            {
              "lessThan": "2.2.51",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.4.9",
              "status": "affected",
              "version": "2.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gnupg:gnupg:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.2.51",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:gnupg:gnupg:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.4.9",
                  "versionStartIncluding": "2.3.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-675",
              "description": "CWE-675 Multiple Operations on Resource in Single-Operation Context",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-02T20:43:57.832Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://gpg.fail/memcpy"
        },
        {
          "url": "https://news.ycombinator.com/item?id=46403200"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2025/12/28/5"
        },
        {
          "url": "https://github.com/gpg/gnupg/commit/115d138ba599328005c5321c0ef9f00355838ca9"
        },
        {
          "url": "https://github.com/gpg/gnupg/blob/ff30683418695f5d2cc9e6cf8c9418e09378ebe4/g10/armor.c#L1305-L1306"
        },
        {
          "url": "https://github.com/gpg/gnupg/compare/gnupg-2.2.50...gnupg-2.2.51"
        },
        {
          "url": "https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-68973",
    "datePublished": "2025-12-28T16:19:11.019Z",
    "dateReserved": "2025-12-28T16:19:10.762Z",
    "dateUpdated": "2026-04-30T03:55:53.604Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-68972 (GCVE-0-2025-68972)

Vulnerability from cvelistv5 – Published: 2025-12-27 22:52 – Updated: 2026-01-02 20:44

Summary

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

mitre

References

3 references

URL	Tags
https://gpg.fail/formfeed
https://news.ycombinator.com/item?id=46404339
https://media.ccc.de/v/39c3-to-sign-or-not-to-sig…

Impacted products

1 product

Vendor	Product	Version
GnuPG	GnuPG	Affected: 0 , ≤ 2.4.8 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-68972",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-29T16:42:56.411653Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-29T16:51:02.621Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://gpg.fail/formfeed"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "GnuPG",
          "vendor": "GnuPG",
          "versions": [
            {
              "lessThanOrEqual": "2.4.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gnupg:gnupg:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "2.4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In GnuPG through 2.4.8, if a signed message has \\f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an \"invalid armor\" message is printed during verification). This is related to use of \\f as a marker to denote truncation of a long plaintext line."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347 Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-02T20:44:27.393Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://gpg.fail/formfeed"
        },
        {
          "url": "https://news.ycombinator.com/item?id=46404339"
        },
        {
          "url": "https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-68972",
    "datePublished": "2025-12-27T22:52:30.957Z",
    "dateReserved": "2025-12-27T22:52:30.688Z",
    "dateUpdated": "2026-01-02T20:44:27.393Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-30258 (GCVE-0-2025-30258)

Vulnerability from cvelistv5 – Published: 2025-03-19 00:00 – Updated: 2025-03-19 20:49

Summary

In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."

Severity

2.7 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-754 - Improper Check for Unusual or Exceptional Conditions

Assigner

mitre

References

3 references

URL	Tags
https://lists.gnupg.org/pipermail/gnupg-announce/…
https://dev.gnupg.org/T7527
https://dev.gnupg.org/rG48978ccb4e20866472ef18436…

Impacted products

1 product

Vendor	Product	Version
GnuPG	GnuPG	Affected: 0 , < 2.5.5 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-30258",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-19T20:49:18.249360Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-19T20:49:22.417Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GnuPG",
          "vendor": "GnuPG",
          "versions": [
            {
              "lessThan": "2.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gnupg:gnupg:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a \"verification DoS.\""
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-754",
              "description": "CWE-754 Improper Check for Unusual or Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-19T19:25:20.407Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://lists.gnupg.org/pipermail/gnupg-announce/2025q1/000491.html"
        },
        {
          "url": "https://dev.gnupg.org/T7527"
        },
        {
          "url": "https://dev.gnupg.org/rG48978ccb4e20866472ef18436a32744350a65158"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-30258",
    "datePublished": "2025-03-19T00:00:00.000Z",
    "dateReserved": "2025-03-19T00:00:00.000Z",
    "dateUpdated": "2025-03-19T20:49:22.417Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-3219 (GCVE-0-2022-3219)

Vulnerability from cvelistv5 – Published: 2023-02-23 00:00 – Updated: 2025-03-12 20:45

Summary

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.

Severity

3.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

denial of service
CWE-787 - Out-of-bounds Write

Assigner

redhat

References

6 references

URL	Tags
https://dev.gnupg.org/D556
https://marc.info/?l=oss-security&m=165696590211434&w=4
https://access.redhat.com/security/cve/CVE-2022-3219
https://bugzilla.redhat.com/show_bug.cgi?id=2127010
https://dev.gnupg.org/T5993
https://security.netapp.com/advisory/ntap-2023032…

Impacted products

1 product

Vendor	Product	Version
n/a	gnupg	Affected: gnupg2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:00:10.537Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://dev.gnupg.org/D556"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://marc.info/?l=oss-security\u0026m=165696590211434\u0026w=4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2022-3219"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2127010"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://dev.gnupg.org/T5993"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230324-0001/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "LOW",
              "baseScore": 3.3,
              "baseSeverity": "LOW",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-3219",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-12T20:45:10.437460Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-12T20:45:46.104Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gnupg",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "gnupg2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "denial of service",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-24T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://dev.gnupg.org/D556"
        },
        {
          "url": "https://marc.info/?l=oss-security\u0026m=165696590211434\u0026w=4"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2022-3219"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2127010"
        },
        {
          "url": "https://dev.gnupg.org/T5993"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230324-0001/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2022-3219",
    "datePublished": "2023-02-23T00:00:00.000Z",
    "dateReserved": "2022-09-15T00:00:00.000Z",
    "dateUpdated": "2025-03-12T20:45:46.104Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-3515 (GCVE-0-2022-3515)

Vulnerability from cvelistv5 – Published: 2023-01-12 00:00 – Updated: 2025-04-08 15:48

Summary

A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-190 - - Integer Overflow or Wraparound
CWE-190 - Integer Overflow or Wraparound

Assigner

redhat

References

5 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=2135610
https://www.gnupg.org/blog/20221017-pepe-left-the…
https://dev.gnupg.org/rK4b7d9cd4a018898d7714ce06f…
https://access.redhat.com/security/cve/CVE-2022-3515
https://security.netapp.com/advisory/ntap-2023070…

Impacted products

1 product

Vendor	Product	Version
n/a	libksba	Affected: Fixed in libksba v1.6.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:14:02.956Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135610"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.gnupg.org/blog/20221017-pepe-left-the-ksba.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://dev.gnupg.org/rK4b7d9cd4a018898d7714ce06f3faf2626c14582b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2022-3515"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230706-0008/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-3515",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T15:48:11.884238Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "CWE-190 Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T15:48:31.667Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "libksba",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in libksba v1.6.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 - Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-06T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135610"
        },
        {
          "url": "https://www.gnupg.org/blog/20221017-pepe-left-the-ksba.html"
        },
        {
          "url": "https://dev.gnupg.org/rK4b7d9cd4a018898d7714ce06f3faf2626c14582b"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2022-3515"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230706-0008/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2022-3515",
    "datePublished": "2023-01-12T00:00:00.000Z",
    "dateReserved": "2022-10-14T00:00:00.000Z",
    "dateUpdated": "2025-04-08T15:48:31.667Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-47629 (GCVE-0-2022-47629)

Vulnerability from cvelistv5 – Published: 2022-12-20 00:00 – Updated: 2025-04-16 17:35

Summary

Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

n/a
CWE-190 - Integer Overflow or Wraparound

Assigner

mitre

References

6 references

URL	Tags
https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksb…
https://dev.gnupg.org/T6284
https://www.debian.org/security/2022/dsa-5305	vendor-advisory
https://lists.debian.org/debian-lts-announce/2022…	mailing-list
https://security.gentoo.org/glsa/202212-07	vendor-advisory
https://security.netapp.com/advisory/ntap-2023031…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:02:35.911Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git%3Ba=commit%3Bh=f61a5ea4e0f6a80fd4b28ef0174bee77793cf070"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://dev.gnupg.org/T6284"
          },
          {
            "name": "DSA-5305",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5305"
          },
          {
            "name": "[debian-lts-announce] 20221224 [SECURITY] [DLA 3248-1] libksba security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00035.html"
          },
          {
            "name": "GLSA-202212-07",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202212-07"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230316-0011/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-47629",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-16T15:50:56.937630Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "CWE-190 Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-16T17:35:45.308Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-16T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git%3Ba=commit%3Bh=f61a5ea4e0f6a80fd4b28ef0174bee77793cf070"
        },
        {
          "url": "https://dev.gnupg.org/T6284"
        },
        {
          "name": "DSA-5305",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5305"
        },
        {
          "name": "[debian-lts-announce] 20221224 [SECURITY] [DLA 3248-1] libksba security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00035.html"
        },
        {
          "name": "GLSA-202212-07",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202212-07"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230316-0011/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-47629",
    "datePublished": "2022-12-20T00:00:00.000Z",
    "dateReserved": "2022-12-20T00:00:00.000Z",
    "dateUpdated": "2025-04-16T17:35:45.308Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-34903 (GCVE-0-2022-34903)

Vulnerability from cvelistv5 – Published: 2022-07-01 21:05 – Updated: 2024-08-03 09:22

Summary

GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre

References

10 references

URL	Tags
https://www.openwall.com/lists/oss-security/2022/…	x_refsource_MISC
https://bugs.debian.org/1014157	x_refsource_MISC
https://dev.gnupg.org/T6027	x_refsource_MISC
http://www.openwall.com/lists/oss-security/2022/07/02/1	mailing-listx_refsource_MLIST
https://www.debian.org/security/2022/dsa-5174	vendor-advisoryx_refsource_DEBIAN
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://security.netapp.com/advisory/ntap-2022082…	x_refsource_CONFIRM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T09:22:10.754Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2022/06/30/1"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.debian.org/1014157"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://dev.gnupg.org/T6027"
          },
          {
            "name": "[oss-security] 20220702 Re: GnuPG signature spoofing via status line injection",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/07/02/1"
          },
          {
            "name": "DSA-5174",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5174"
          },
          {
            "name": "FEDORA-2022-aa14d396dd",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPTAR76EIZY7NQFENSOZO7U473257OVZ/"
          },
          {
            "name": "FEDORA-2022-1124e5882d",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VN63GBTMRWO36Y7BKA2WQHROAKCXKCBL/"
          },
          {
            "name": "FEDORA-2022-0dbfb7e270",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRLWJQ76A4UKHI3Q36BKSJKS4LFLQO33/"
          },
          {
            "name": "FEDORA-2022-1747eea46c",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU64FUVG2PRZBSHFOQRSP7KDVEIZ23OS/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220826-0005/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim\u0027s keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-26T14:06:28.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.openwall.com/lists/oss-security/2022/06/30/1"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugs.debian.org/1014157"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://dev.gnupg.org/T6027"
        },
        {
          "name": "[oss-security] 20220702 Re: GnuPG signature spoofing via status line injection",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/07/02/1"
        },
        {
          "name": "DSA-5174",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5174"
        },
        {
          "name": "FEDORA-2022-aa14d396dd",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPTAR76EIZY7NQFENSOZO7U473257OVZ/"
        },
        {
          "name": "FEDORA-2022-1124e5882d",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VN63GBTMRWO36Y7BKA2WQHROAKCXKCBL/"
        },
        {
          "name": "FEDORA-2022-0dbfb7e270",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRLWJQ76A4UKHI3Q36BKSJKS4LFLQO33/"
        },
        {
          "name": "FEDORA-2022-1747eea46c",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU64FUVG2PRZBSHFOQRSP7KDVEIZ23OS/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220826-0005/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2022-34903",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim\u0027s keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.openwall.com/lists/oss-security/2022/06/30/1",
              "refsource": "MISC",
              "url": "https://www.openwall.com/lists/oss-security/2022/06/30/1"
            },
            {
              "name": "https://bugs.debian.org/1014157",
              "refsource": "MISC",
              "url": "https://bugs.debian.org/1014157"
            },
            {
              "name": "https://dev.gnupg.org/T6027",
              "refsource": "MISC",
              "url": "https://dev.gnupg.org/T6027"
            },
            {
              "name": "[oss-security] 20220702 Re: GnuPG signature spoofing via status line injection",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2022/07/02/1"
            },
            {
              "name": "DSA-5174",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5174"
            },
            {
              "name": "FEDORA-2022-aa14d396dd",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NPTAR76EIZY7NQFENSOZO7U473257OVZ/"
            },
            {
              "name": "FEDORA-2022-1124e5882d",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VN63GBTMRWO36Y7BKA2WQHROAKCXKCBL/"
            },
            {
              "name": "FEDORA-2022-0dbfb7e270",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FRLWJQ76A4UKHI3Q36BKSJKS4LFLQO33/"
            },
            {
              "name": "FEDORA-2022-1747eea46c",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VU64FUVG2PRZBSHFOQRSP7KDVEIZ23OS/"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220826-0005/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220826-0005/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-34903",
    "datePublished": "2022-07-01T21:05:18.000Z",
    "dateReserved": "2022-07-01T00:00:00.000Z",
    "dateUpdated": "2024-08-03T09:22:10.754Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-41990 (GCVE-0-2026-41990)

Vulnerability from nvd – Published: 2026-04-23 04:39 – Updated: 2026-04-23 16:22

Summary

Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.

Severity

4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-787 - Out-of-bounds Write

Assigner

mitre

References

3 references

URL	Tags
https://lists.gnupg.org/pipermail/gnupg-announce/…
https://www.openwall.com/lists/oss-security/2026/…
https://dev.gnupg.org/T8208

Impacted products

1 product

Vendor	Product	Version
gnupg	Libgcrypt	Affected: 1.12.0 , < 1.12.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41990",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-23T15:58:26.094245Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-23T16:22:42.096Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Libgcrypt",
          "vendor": "gnupg",
          "versions": [
            {
              "lessThan": "1.12.2",
              "status": "affected",
              "version": "1.12.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.12.2",
                  "versionStartIncluding": "1.12.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-23T05:10:55.346Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/04/21/1"
        },
        {
          "url": "https://dev.gnupg.org/T8208"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-41990",
    "datePublished": "2026-04-23T04:39:04.524Z",
    "dateReserved": "2026-04-23T04:39:04.114Z",
    "dateUpdated": "2026-04-23T16:22:42.096Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41989 (GCVE-0-2026-41989)

Vulnerability from nvd – Published: 2026-04-23 04:30 – Updated: 2026-04-23 16:22

Summary

Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.

Severity

6.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-787 - Out-of-bounds Write

Assigner

mitre

References

3 references

URL	Tags
https://lists.gnupg.org/pipermail/gnupg-announce/…
https://dev.gnupg.org/T8211
https://www.openwall.com/lists/oss-security/2026/…

Impacted products

1 product

Vendor	Product	Version
gnupg	Libgcrypt	Affected: 1.8.8 , < 1.10.4 (semver) Affected: 1.11.0 , < 1.11.3 (semver) Affected: 1.12.0 , < 1.12.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41989",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-23T15:58:58.277481Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-23T16:22:47.896Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Libgcrypt",
          "vendor": "gnupg",
          "versions": [
            {
              "lessThan": "1.10.4",
              "status": "affected",
              "version": "1.8.8",
              "versionType": "semver"
            },
            {
              "lessThan": "1.11.3",
              "status": "affected",
              "version": "1.11.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.12.2",
              "status": "affected",
              "version": "1.12.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.10.4",
                  "versionStartIncluding": "1.8.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.11.3",
                  "versionStartIncluding": "1.11.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.12.2",
                  "versionStartIncluding": "1.12.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-23T05:10:34.992Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html"
        },
        {
          "url": "https://dev.gnupg.org/T8211"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/04/21/1"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-41989",
    "datePublished": "2026-04-23T04:30:26.124Z",
    "dateReserved": "2026-04-23T04:30:25.690Z",
    "dateUpdated": "2026-04-23T16:22:47.896Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-24883 (GCVE-0-2026-24883)

Vulnerability from nvd – Published: 2026-01-27 18:43 – Updated: 2026-01-28 15:52

Summary

In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of service (application crash).

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-476 - NULL Pointer Dereference

Assigner

mitre

References

2 references

URL	Tags
https://www.openwall.com/lists/oss-security/2026/…
https://dev.gnupg.org/T8049

Impacted products

1 product

Vendor	Product	Version
GnuPG	GnuPG	Affected: 2.5.3 , < 2.5.17 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24883",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-27T20:02:25.525861Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-27T20:02:38.338Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GnuPG",
          "vendor": "GnuPG",
          "versions": [
            {
              "lessThan": "2.5.17",
              "status": "affected",
              "version": "2.5.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gnupg:gnupg:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.5.17",
                  "versionStartIncluding": "2.5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig-\u003edata[] set to a NULL value, leading to a denial of service (application crash)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-28T15:52:11.076Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/01/27/8"
        },
        {
          "url": "https://dev.gnupg.org/T8049"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-24883",
    "datePublished": "2026-01-27T18:43:18.883Z",
    "dateReserved": "2026-01-27T18:43:18.620Z",
    "dateUpdated": "2026-01-28T15:52:11.076Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-24882 (GCVE-0-2026-24882)

Vulnerability from nvd – Published: 2026-01-27 18:40 – Updated: 2026-01-28 15:45

Summary

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-121 - Stack-based Buffer Overflow

Assigner

mitre

References

2 references

URL	Tags
https://www.openwall.com/lists/oss-security/2026/…
https://dev.gnupg.org/T8045

Impacted products

1 product

Vendor	Product	Version
GnuPG	GnuPG	Affected: 0 , < 2.5.17 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24882",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-27T20:07:25.362188Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-27T20:07:38.876Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GnuPG",
          "vendor": "GnuPG",
          "versions": [
            {
              "lessThan": "2.5.17",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gnupg:gnupg:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121 Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-28T15:45:56.231Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/01/27/8"
        },
        {
          "url": "https://dev.gnupg.org/T8045"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-24882",
    "datePublished": "2026-01-27T18:40:18.166Z",
    "dateReserved": "2026-01-27T18:40:17.903Z",
    "dateUpdated": "2026-01-28T15:45:56.231Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-24881 (GCVE-0-2026-24881)

Vulnerability from nvd – Published: 2026-01-27 18:36 – Updated: 2026-01-27 20:08

Summary

In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This can easily be leveraged for denial of service; however, there is also memory corruption that could lead to remote code execution.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-121 - Stack-based Buffer Overflow

Assigner

mitre

References

2 references

URL	Tags
https://www.openwall.com/lists/oss-security/2026/…
https://dev.gnupg.org/T8044

Impacted products

1 product

Vendor	Product	Version
GnuPG	GnuPG	Affected: 2.5.13 , < 2.5.17 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24881",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-27T20:08:45.733664Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-27T20:08:54.449Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GnuPG",
          "vendor": "GnuPG",
          "versions": [
            {
              "lessThan": "2.5.17",
              "status": "affected",
              "version": "2.5.13",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gnupg:gnupg:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.5.17",
                  "versionStartIncluding": "2.5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This can easily be leveraged for denial of service; however, there is also memory corruption that could lead to remote code execution."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121 Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-27T18:52:54.994Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/01/27/8"
        },
        {
          "url": "https://dev.gnupg.org/T8044"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-24881",
    "datePublished": "2026-01-27T18:36:56.727Z",
    "dateReserved": "2026-01-27T18:36:56.490Z",
    "dateUpdated": "2026-01-27T20:08:54.449Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-68973 (GCVE-0-2025-68973)

Vulnerability from nvd – Published: 2025-12-28 16:19 – Updated: 2026-04-30 03:55

Summary

In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-675 - Multiple Operations on Resource in Single-Operation Context

Assigner

mitre

References

9 references

URL	Tags
https://gpg.fail/memcpy
https://news.ycombinator.com/item?id=46403200
https://www.openwall.com/lists/oss-security/2025/…
https://github.com/gpg/gnupg/commit/115d138ba5993…
https://github.com/gpg/gnupg/blob/ff30683418695f5…
https://github.com/gpg/gnupg/compare/gnupg-2.2.50…
https://media.ccc.de/v/39c3-to-sign-or-not-to-sig…
http://www.openwall.com/lists/oss-security/2025/1…
https://lists.debian.org/debian-lts-announce/2026…

Impacted products

1 product

Vendor	Product	Version
GnuPG	GnuPG	Affected: 0 , < 2.2.51 (semver) Affected: 2.3.0 , < 2.4.9 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-68973",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-29T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-30T03:55:53.604Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://gpg.fail/memcpy"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-14T19:04:33.329Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/12/29/11"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "GnuPG",
          "vendor": "GnuPG",
          "versions": [
            {
              "lessThan": "2.2.51",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.4.9",
              "status": "affected",
              "version": "2.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gnupg:gnupg:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.2.51",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:gnupg:gnupg:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.4.9",
                  "versionStartIncluding": "2.3.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-675",
              "description": "CWE-675 Multiple Operations on Resource in Single-Operation Context",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-02T20:43:57.832Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://gpg.fail/memcpy"
        },
        {
          "url": "https://news.ycombinator.com/item?id=46403200"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2025/12/28/5"
        },
        {
          "url": "https://github.com/gpg/gnupg/commit/115d138ba599328005c5321c0ef9f00355838ca9"
        },
        {
          "url": "https://github.com/gpg/gnupg/blob/ff30683418695f5d2cc9e6cf8c9418e09378ebe4/g10/armor.c#L1305-L1306"
        },
        {
          "url": "https://github.com/gpg/gnupg/compare/gnupg-2.2.50...gnupg-2.2.51"
        },
        {
          "url": "https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-68973",
    "datePublished": "2025-12-28T16:19:11.019Z",
    "dateReserved": "2025-12-28T16:19:10.762Z",
    "dateUpdated": "2026-04-30T03:55:53.604Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-68972 (GCVE-0-2025-68972)

Vulnerability from nvd – Published: 2025-12-27 22:52 – Updated: 2026-01-02 20:44

Summary

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

mitre

References

3 references

URL	Tags
https://gpg.fail/formfeed
https://news.ycombinator.com/item?id=46404339
https://media.ccc.de/v/39c3-to-sign-or-not-to-sig…

Impacted products

1 product

Vendor	Product	Version
GnuPG	GnuPG	Affected: 0 , ≤ 2.4.8 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-68972",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-29T16:42:56.411653Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-29T16:51:02.621Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://gpg.fail/formfeed"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "GnuPG",
          "vendor": "GnuPG",
          "versions": [
            {
              "lessThanOrEqual": "2.4.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gnupg:gnupg:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "2.4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In GnuPG through 2.4.8, if a signed message has \\f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an \"invalid armor\" message is printed during verification). This is related to use of \\f as a marker to denote truncation of a long plaintext line."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347 Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-02T20:44:27.393Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://gpg.fail/formfeed"
        },
        {
          "url": "https://news.ycombinator.com/item?id=46404339"
        },
        {
          "url": "https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-68972",
    "datePublished": "2025-12-27T22:52:30.957Z",
    "dateReserved": "2025-12-27T22:52:30.688Z",
    "dateUpdated": "2026-01-02T20:44:27.393Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-30258 (GCVE-0-2025-30258)

Vulnerability from nvd – Published: 2025-03-19 00:00 – Updated: 2025-03-19 20:49

Summary

In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."

Severity

2.7 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-754 - Improper Check for Unusual or Exceptional Conditions

Assigner

mitre

References

3 references

URL	Tags
https://lists.gnupg.org/pipermail/gnupg-announce/…
https://dev.gnupg.org/T7527
https://dev.gnupg.org/rG48978ccb4e20866472ef18436…

Impacted products

1 product

Vendor	Product	Version
GnuPG	GnuPG	Affected: 0 , < 2.5.5 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-30258",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-19T20:49:18.249360Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-19T20:49:22.417Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GnuPG",
          "vendor": "GnuPG",
          "versions": [
            {
              "lessThan": "2.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gnupg:gnupg:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a \"verification DoS.\""
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-754",
              "description": "CWE-754 Improper Check for Unusual or Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-19T19:25:20.407Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://lists.gnupg.org/pipermail/gnupg-announce/2025q1/000491.html"
        },
        {
          "url": "https://dev.gnupg.org/T7527"
        },
        {
          "url": "https://dev.gnupg.org/rG48978ccb4e20866472ef18436a32744350a65158"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-30258",
    "datePublished": "2025-03-19T00:00:00.000Z",
    "dateReserved": "2025-03-19T00:00:00.000Z",
    "dateUpdated": "2025-03-19T20:49:22.417Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-3219 (GCVE-0-2022-3219)

Vulnerability from nvd – Published: 2023-02-23 00:00 – Updated: 2025-03-12 20:45

Summary

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.

Severity

3.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

denial of service
CWE-787 - Out-of-bounds Write

Assigner

redhat

References

6 references

URL	Tags
https://dev.gnupg.org/D556
https://marc.info/?l=oss-security&m=165696590211434&w=4
https://access.redhat.com/security/cve/CVE-2022-3219
https://bugzilla.redhat.com/show_bug.cgi?id=2127010
https://dev.gnupg.org/T5993
https://security.netapp.com/advisory/ntap-2023032…

Impacted products

1 product

Vendor	Product	Version
n/a	gnupg	Affected: gnupg2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:00:10.537Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://dev.gnupg.org/D556"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://marc.info/?l=oss-security\u0026m=165696590211434\u0026w=4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2022-3219"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2127010"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://dev.gnupg.org/T5993"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230324-0001/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "LOW",
              "baseScore": 3.3,
              "baseSeverity": "LOW",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-3219",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-12T20:45:10.437460Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-12T20:45:46.104Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gnupg",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "gnupg2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "denial of service",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-24T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://dev.gnupg.org/D556"
        },
        {
          "url": "https://marc.info/?l=oss-security\u0026m=165696590211434\u0026w=4"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2022-3219"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2127010"
        },
        {
          "url": "https://dev.gnupg.org/T5993"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230324-0001/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2022-3219",
    "datePublished": "2023-02-23T00:00:00.000Z",
    "dateReserved": "2022-09-15T00:00:00.000Z",
    "dateUpdated": "2025-03-12T20:45:46.104Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-3515 (GCVE-0-2022-3515)

Vulnerability from nvd – Published: 2023-01-12 00:00 – Updated: 2025-04-08 15:48

Summary

A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-190 - - Integer Overflow or Wraparound
CWE-190 - Integer Overflow or Wraparound

Assigner

redhat

References

5 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=2135610
https://www.gnupg.org/blog/20221017-pepe-left-the…
https://dev.gnupg.org/rK4b7d9cd4a018898d7714ce06f…
https://access.redhat.com/security/cve/CVE-2022-3515
https://security.netapp.com/advisory/ntap-2023070…

Impacted products

1 product

Vendor	Product	Version
n/a	libksba	Affected: Fixed in libksba v1.6.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:14:02.956Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135610"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.gnupg.org/blog/20221017-pepe-left-the-ksba.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://dev.gnupg.org/rK4b7d9cd4a018898d7714ce06f3faf2626c14582b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2022-3515"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230706-0008/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-3515",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T15:48:11.884238Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "CWE-190 Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T15:48:31.667Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "libksba",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in libksba v1.6.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 - Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-06T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135610"
        },
        {
          "url": "https://www.gnupg.org/blog/20221017-pepe-left-the-ksba.html"
        },
        {
          "url": "https://dev.gnupg.org/rK4b7d9cd4a018898d7714ce06f3faf2626c14582b"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2022-3515"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230706-0008/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2022-3515",
    "datePublished": "2023-01-12T00:00:00.000Z",
    "dateReserved": "2022-10-14T00:00:00.000Z",
    "dateUpdated": "2025-04-08T15:48:31.667Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-47629 (GCVE-0-2022-47629)

Vulnerability from nvd – Published: 2022-12-20 00:00 – Updated: 2025-04-16 17:35

Summary

Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

n/a
CWE-190 - Integer Overflow or Wraparound

Assigner

mitre

References

6 references

URL	Tags
https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksb…
https://dev.gnupg.org/T6284
https://www.debian.org/security/2022/dsa-5305	vendor-advisory
https://lists.debian.org/debian-lts-announce/2022…	mailing-list
https://security.gentoo.org/glsa/202212-07	vendor-advisory
https://security.netapp.com/advisory/ntap-2023031…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:02:35.911Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git%3Ba=commit%3Bh=f61a5ea4e0f6a80fd4b28ef0174bee77793cf070"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://dev.gnupg.org/T6284"
          },
          {
            "name": "DSA-5305",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5305"
          },
          {
            "name": "[debian-lts-announce] 20221224 [SECURITY] [DLA 3248-1] libksba security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00035.html"
          },
          {
            "name": "GLSA-202212-07",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202212-07"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230316-0011/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-47629",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-16T15:50:56.937630Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "CWE-190 Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-16T17:35:45.308Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-16T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git%3Ba=commit%3Bh=f61a5ea4e0f6a80fd4b28ef0174bee77793cf070"
        },
        {
          "url": "https://dev.gnupg.org/T6284"
        },
        {
          "name": "DSA-5305",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5305"
        },
        {
          "name": "[debian-lts-announce] 20221224 [SECURITY] [DLA 3248-1] libksba security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00035.html"
        },
        {
          "name": "GLSA-202212-07",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202212-07"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230316-0011/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-47629",
    "datePublished": "2022-12-20T00:00:00.000Z",
    "dateReserved": "2022-12-20T00:00:00.000Z",
    "dateUpdated": "2025-04-16T17:35:45.308Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-34903 (GCVE-0-2022-34903)

Vulnerability from nvd – Published: 2022-07-01 21:05 – Updated: 2024-08-03 09:22

Summary

GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre

References

10 references

URL	Tags
https://www.openwall.com/lists/oss-security/2022/…	x_refsource_MISC
https://bugs.debian.org/1014157	x_refsource_MISC
https://dev.gnupg.org/T6027	x_refsource_MISC
http://www.openwall.com/lists/oss-security/2022/07/02/1	mailing-listx_refsource_MLIST
https://www.debian.org/security/2022/dsa-5174	vendor-advisoryx_refsource_DEBIAN
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://security.netapp.com/advisory/ntap-2022082…	x_refsource_CONFIRM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T09:22:10.754Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2022/06/30/1"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.debian.org/1014157"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://dev.gnupg.org/T6027"
          },
          {
            "name": "[oss-security] 20220702 Re: GnuPG signature spoofing via status line injection",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/07/02/1"
          },
          {
            "name": "DSA-5174",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5174"
          },
          {
            "name": "FEDORA-2022-aa14d396dd",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPTAR76EIZY7NQFENSOZO7U473257OVZ/"
          },
          {
            "name": "FEDORA-2022-1124e5882d",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VN63GBTMRWO36Y7BKA2WQHROAKCXKCBL/"
          },
          {
            "name": "FEDORA-2022-0dbfb7e270",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRLWJQ76A4UKHI3Q36BKSJKS4LFLQO33/"
          },
          {
            "name": "FEDORA-2022-1747eea46c",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU64FUVG2PRZBSHFOQRSP7KDVEIZ23OS/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220826-0005/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim\u0027s keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-26T14:06:28.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.openwall.com/lists/oss-security/2022/06/30/1"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugs.debian.org/1014157"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://dev.gnupg.org/T6027"
        },
        {
          "name": "[oss-security] 20220702 Re: GnuPG signature spoofing via status line injection",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/07/02/1"
        },
        {
          "name": "DSA-5174",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5174"
        },
        {
          "name": "FEDORA-2022-aa14d396dd",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPTAR76EIZY7NQFENSOZO7U473257OVZ/"
        },
        {
          "name": "FEDORA-2022-1124e5882d",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VN63GBTMRWO36Y7BKA2WQHROAKCXKCBL/"
        },
        {
          "name": "FEDORA-2022-0dbfb7e270",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRLWJQ76A4UKHI3Q36BKSJKS4LFLQO33/"
        },
        {
          "name": "FEDORA-2022-1747eea46c",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU64FUVG2PRZBSHFOQRSP7KDVEIZ23OS/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220826-0005/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2022-34903",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim\u0027s keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.openwall.com/lists/oss-security/2022/06/30/1",
              "refsource": "MISC",
              "url": "https://www.openwall.com/lists/oss-security/2022/06/30/1"
            },
            {
              "name": "https://bugs.debian.org/1014157",
              "refsource": "MISC",
              "url": "https://bugs.debian.org/1014157"
            },
            {
              "name": "https://dev.gnupg.org/T6027",
              "refsource": "MISC",
              "url": "https://dev.gnupg.org/T6027"
            },
            {
              "name": "[oss-security] 20220702 Re: GnuPG signature spoofing via status line injection",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2022/07/02/1"
            },
            {
              "name": "DSA-5174",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5174"
            },
            {
              "name": "FEDORA-2022-aa14d396dd",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NPTAR76EIZY7NQFENSOZO7U473257OVZ/"
            },
            {
              "name": "FEDORA-2022-1124e5882d",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VN63GBTMRWO36Y7BKA2WQHROAKCXKCBL/"
            },
            {
              "name": "FEDORA-2022-0dbfb7e270",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FRLWJQ76A4UKHI3Q36BKSJKS4LFLQO33/"
            },
            {
              "name": "FEDORA-2022-1747eea46c",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VU64FUVG2PRZBSHFOQRSP7KDVEIZ23OS/"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220826-0005/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220826-0005/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-34903",
    "datePublished": "2022-07-01T21:05:18.000Z",
    "dateReserved": "2022-07-01T00:00:00.000Z",
    "dateUpdated": "2024-08-03T09:22:10.754Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-40528 (GCVE-0-2021-40528)

Vulnerability from nvd – Published: 2021-09-06 00:00 – Updated: 2025-06-09 15:13

Summary

The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

n/a
CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

Assigner

mitre

References

5 references

URL	Tags
https://eprint.iacr.org/2021/923
https://ibm.github.io/system-security-research-up…
https://ibm.github.io/system-security-research-up…
https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcr…
https://security.gentoo.org/glsa/202210-13	vendor-advisory

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T02:44:10.845Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://eprint.iacr.org/2021/923"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://ibm.github.io/system-security-research-updates/2021/07/20/insecurity-elgamal-pt1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://ibm.github.io/system-security-research-updates/2021/09/06/insecurity-elgamal-pt2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=3462280f2e23e16adf3ed5176e0f2413d8861320"
          },
          {
            "name": "GLSA-202210-13",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202210-13"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-40528",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-09T15:12:20.359985Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-327",
                "description": "CWE-327 Use of a Broken or Risky Cryptographic Algorithm",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-09T15:13:03.906Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver\u0027s public key, the generator defined by the receiver\u0027s public key, and the sender\u0027s ephemeral exponents can lead to a cross-configuration attack against OpenPGP."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-31T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://eprint.iacr.org/2021/923"
        },
        {
          "url": "https://ibm.github.io/system-security-research-updates/2021/07/20/insecurity-elgamal-pt1"
        },
        {
          "url": "https://ibm.github.io/system-security-research-updates/2021/09/06/insecurity-elgamal-pt2"
        },
        {
          "url": "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=3462280f2e23e16adf3ed5176e0f2413d8861320"
        },
        {
          "name": "GLSA-202210-13",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202210-13"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-40528",
    "datePublished": "2021-09-06T00:00:00.000Z",
    "dateReserved": "2021-09-06T00:00:00.000Z",
    "dateUpdated": "2025-06-09T15:13:03.906Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GCVE-1-2026-0008

Vulnerability from gna-1 – Published: 2026-01-28 13:48 – Updated: 2026-01-28 13:48

Title

gpg-agent stack buffer overflow in pkdecrypt using KEM

Summary

A crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key (AES Key Wrap ciphertext) can cause a stack buffer overflow in gpg-agent during PKDECRYPT --kem=CMS handling. The root cause is an unbounded session key length derived from attacker-controlled ciphertext and used as the AES Key Wrap output length when decrypting into a fixed-size stack buffer. libgcrypt’s AES-KW unwrap copies attacker-controlled bytes into the caller-provided output buffer before performing integrity checks, so the stack overflow occurs even if later CMS or key-wrap integrity validation fails.

Severity

10 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CWE

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Assigner

GNA-1

References

1 reference

URL	Tags
https://dev.gnupg.org/T8044	issue-tracking

Impacted products

1 product

Vendor	Product	Version
gnupg	gpg-agent	Affected: 2.5.13 , < 2.5.17

Credits

OpenAI Security Research Werner Koch

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "gpg-agent",
          "vendor": "gnupg",
          "versions": [
            {
              "lessThan": "2.5.17",
              "status": "affected",
              "version": "2.5.13"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "OpenAI Security Research"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Werner Koch"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped\u003cbr\u003e\nsession key (AES Key Wrap ciphertext) can cause a stack buffer overflow in\u003cbr\u003e\ngpg-agent during PKDECRYPT --kem=CMS handling. The root cause is an\u003cbr\u003e\nunbounded session key length derived from attacker-controlled ciphertext\u003cbr\u003e\nand used as the AES Key Wrap output length when decrypting into a\u003cbr\u003e\nfixed-size stack buffer. libgcrypt\u2019s AES-KW unwrap copies\u003cbr\u003e\nattacker-controlled bytes into the caller-provided output buffer before\u003cbr\u003e\nperforming integrity checks, so the stack overflow occurs even if later CMS\u003cbr\u003e\nor key-wrap integrity validation fails.\u003cbr\u003e"
            }
          ],
          "value": "A crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped\n\nsession key (AES Key Wrap ciphertext) can cause a stack buffer overflow in\n\ngpg-agent during PKDECRYPT --kem=CMS handling. The root cause is an\n\nunbounded session key length derived from attacker-controlled ciphertext\n\nand used as the AES Key Wrap output length when decrypting into a\n\nfixed-size stack buffer. libgcrypt\u2019s AES-KW unwrap copies\n\nattacker-controlled bytes into the caller-provided output buffer before\n\nperforming integrity checks, so the stack overflow occurs even if later CMS\n\nor key-wrap integrity validation fails."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://dev.gnupg.org/T8044"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "gpg-agent stack buffer overflow in pkdecrypt using KEM",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "datePublished": "2026-01-28T13:48:12.350509Z",
    "dateUpdated": "2026-01-28T13:48:12.350509Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "gcve-1-2026-0008",
    "vulnerabilitylookup_history": [
      [
        "alexandre.dulaunoy@circl.lu",
        "2026-01-28T13:48:12.350509Z"
      ]
    ]
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GCVE-1-2026-0001

Vulnerability from gna-1 – Published: 2026-01-02 10:20 – Updated: 2026-01-02 13:31

Title

Bundle reference to gpg.fail

Summary

Reference to the gpg.fail 1. Multiple Plaintext Attack on Detached PGP Signatures in GnuPG - https://gpg.fail/detached 2. GnuPG Accepts Path Separators and Path Traversals in Literal Data "Filename" Field - https://gpg.fail/filename 3. Cleartext Signature Plaintext Truncated for Hash Calculation - https://gpg.fail/formfeed 4. Encrypted message malleability checks are incorrectly enforced causing plaintext recovery attacks - https://gpg.fail/malleability 5. Memory Corruption in ASCII-Armor Parsing - https://gpg.fail/memcpy 6. Trusted comment injection (minisign) - https://gpg.fail/minisign 7. Cleartext Signature Forgery in the NotDashEscaped header implementation in GnuPG - https://gpg.fail/notdash 8. OpenPGP Cleartext Signature Framework Susceptible to Format Confusion - https://gpg.fail/notsoclear 9. GnuPG Output Fails To Distinguish Signature Verification Success From Message Content https://gpg.fail/noverify 10. Cleartext Signature Forgery in GnuPG - https://gpg.fail/nullbyte 11. Radix64 Line-Truncation Enabling Polyglot Attacks - https://gpg.fail/polyglot 12. GnuPG may downgrade digest algorithm to SHA1 during key signature checking - https://gpg.fail/sha1 13. GnuPG Trust Packet Parsing Enables Adding Arbitrary Subkeys - https://gpg.fail/trust 14. Trusted comment Injection (minisign) - https://gpg.fail/trustcomment

Severity

No CVSS data available.

CWE

Assigner

GNA-1

References

1 reference

URL	Tags
https://gpg.fail/

Impacted products

1 product

Vendor	Product	Version
gnupg	gnupg	Affected:

Relationships

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "gnupg",
          "vendor": "gnupg",
          "versions": [
            {
              "status": "affected"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eReference to the\u0026nbsp;gpg.fail\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e1.\u0026nbsp; Multiple Plaintext Attack on Detached PGP Signatures in GnuPG -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/detached\"\u003ehttps://gpg.fail/detached\u003c/a\u003e\u003cbr\u003e2.\u0026nbsp; GnuPG Accepts Path Separators and Path Traversals in Literal Data \"Filename\" Field -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/filename\"\u003ehttps://gpg.fail/filename\u003c/a\u003e\u003cbr\u003e3.\u0026nbsp; Cleartext Signature Plaintext Truncated for Hash Calculation -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/formfeed\"\u003ehttps://gpg.fail/formfeed\u003c/a\u003e\u003cbr\u003e4.\u0026nbsp; Encrypted message malleability checks are incorrectly enforced causing plaintext recovery attacks -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/malleability\"\u003ehttps://gpg.fail/malleability\u003c/a\u003e\u003cbr\u003e5.\u0026nbsp; Memory Corruption in ASCII-Armor Parsing -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/memcpy\"\u003ehttps://gpg.fail/memcpy\u003c/a\u003e\u003cbr\u003e6.\u0026nbsp; Trusted comment injection (minisign) -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/minisign\"\u003ehttps://gpg.fail/minisign\u003c/a\u003e\u003cbr\u003e7.\u0026nbsp; Cleartext Signature Forgery in the NotDashEscaped header implementation in GnuPG -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/notdash\"\u003ehttps://gpg.fail/notdash\u003c/a\u003e\u003cbr\u003e8.\u0026nbsp; OpenPGP Cleartext Signature Framework Susceptible to Format Confusion -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/notsoclear\"\u003ehttps://gpg.fail/notsoclear\u003c/a\u003e\u003cbr\u003e9.\u0026nbsp; GnuPG Output Fails To Distinguish Signature Verification Success From Message Content\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/noverify\"\u003ehttps://gpg.fail/noverify\u003c/a\u003e\u003cbr\u003e10.\u0026nbsp; Cleartext Signature Forgery in GnuPG -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/nullbyte\"\u003ehttps://gpg.fail/nullbyte\u003c/a\u003e\u003cbr\u003e11.\u0026nbsp; Radix64 Line-Truncation Enabling Polyglot Attacks -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/polyglot\"\u003ehttps://gpg.fail/polyglot\u003c/a\u003e\u003cbr\u003e12.\u0026nbsp; GnuPG may downgrade digest algorithm to SHA1 during key signature checking -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/sha1\"\u003ehttps://gpg.fail/sha1\u003c/a\u003e\u003cbr\u003e13.\u0026nbsp; GnuPG Trust Packet Parsing Enables Adding Arbitrary Subkeys -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/trust\"\u003ehttps://gpg.fail/trust\u003c/a\u003e\u003cbr\u003e14.\u0026nbsp; Trusted comment Injection (minisign) - \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/trustcomment\"\u003ehttps://gpg.fail/trustcomment\u003c/a\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e"
            }
          ],
          "value": "Reference to the\u00a0gpg.fail\n\n\n\n\n1.\u00a0 Multiple Plaintext Attack on Detached PGP Signatures in GnuPG -\u00a0 https://gpg.fail/detached \n2.\u00a0 GnuPG Accepts Path Separators and Path Traversals in Literal Data \"Filename\" Field -\u00a0 https://gpg.fail/filename \n3.\u00a0 Cleartext Signature Plaintext Truncated for Hash Calculation -\u00a0 https://gpg.fail/formfeed \n4.\u00a0 Encrypted message malleability checks are incorrectly enforced causing plaintext recovery attacks -\u00a0 https://gpg.fail/malleability \n5.\u00a0 Memory Corruption in ASCII-Armor Parsing -\u00a0 https://gpg.fail/memcpy \n6.\u00a0 Trusted comment injection (minisign) -\u00a0 https://gpg.fail/minisign \n7.\u00a0 Cleartext Signature Forgery in the NotDashEscaped header implementation in GnuPG -\u00a0 https://gpg.fail/notdash \n8.\u00a0 OpenPGP Cleartext Signature Framework Susceptible to Format Confusion -\u00a0 https://gpg.fail/notsoclear \n9.\u00a0 GnuPG Output Fails To Distinguish Signature Verification Success From Message Content\u00a0 https://gpg.fail/noverify \n10.\u00a0 Cleartext Signature Forgery in GnuPG -\u00a0 https://gpg.fail/nullbyte \n11.\u00a0 Radix64 Line-Truncation Enabling Polyglot Attacks -\u00a0 https://gpg.fail/polyglot \n12.\u00a0 GnuPG may downgrade digest algorithm to SHA1 during key signature checking -\u00a0 https://gpg.fail/sha1 \n13.\u00a0 GnuPG Trust Packet Parsing Enables Adding Arbitrary Subkeys -\u00a0 https://gpg.fail/trust \n14.\u00a0 Trusted comment Injection (minisign) -  https://gpg.fail/trustcomment"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "url": "https://gpg.fail/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Bundle reference to gpg.fail",
      "x_gcve": [
        {
          "recordType": "advisory"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "datePublished": "2026-01-02T10:20:00.000Z",
    "dateUpdated": "2026-01-02T13:31:14.359346Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "gcve-1-2026-0001",
    "vulnerabilitylookup_history": [
      [
        "alexandre.dulaunoy@circl.lu",
        "2026-01-02T10:20:24.357623Z"
      ],
      [
        "alexandre.dulaunoy@circl.lu",
        "2026-01-02T10:20:45.873825Z"
      ],
      [
        "alexandre.dulaunoy@circl.lu",
        "2026-01-02T13:28:12.107109Z"
      ],
      [
        "alexandre.dulaunoy@circl.lu",
        "2026-01-02T13:31:14.359346Z"
      ]
    ]
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

VAR-201805-0227

Vulnerability from variot - Updated: 2024-05-17 19:19

The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification. In multiple mail clients OpenPGP and S/MIME A plaintext message may be leaked when decrypting the message. OpenPGP and S/MIME For e-mail clients that support, it is possible to establish a channel for sending plaintext by decrypting encrypted e-mail inserted with content crafted by an attacker with the user's e-mail client. The discoverer can attack with this vulnerability "CBC/CFB gadget attack" I call it. For example HTML image By inserting a tag, the decrypted message is HTTP It may be sent as part of the request. * CVE-2017-17688: OpenPGP CFB Attacks * CVE-2017-17689: S/MIME CBC Attacks Some email clients also use multipart MIME Because the message is not properly separated and processed, attackers can process encrypted mail in plain text. MIME It can be included in the part. in this case, CBC/CFB gadget attack The plaintext message may be sent without executing. Detail is, Articles provided by the discoverer Please refer to.A remote attacker may obtain plaintext from encrypted mail without the key information required for decryption. OpenPGP is prone to an information disclosure vulnerability. An attacker can exploit this issue to perform man-in-the-middle attacks and obtain sensitive information. Successful exploits will lead to other attacks. OpenPGP is a set of email encryption standards that supports multiple platforms

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201805-0227",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "webmail",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "roundcube",
        "version": null
      },
      {
        "model": "emclient",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "emclient",
        "version": null
      },
      {
        "model": "imp",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "horde",
        "version": null
      },
      {
        "model": "mail",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": null
      },
      {
        "model": "postbox",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "postbox",
        "version": null
      },
      {
        "model": "airmail",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "bloop",
        "version": null
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "mozilla",
        "version": null
      },
      {
        "model": "maildroid",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "flipdogsolutions",
        "version": null
      },
      {
        "model": "r2mail2",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "r2mail2",
        "version": null
      },
      {
        "model": "mailmate",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "freron",
        "version": null
      },
      {
        "model": "outlook",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "2007"
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "9folders",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "airmail",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "apple",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "evolution",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "flipdog",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "gpgtools",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "gnupg",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "google",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "ibm",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "kmail",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "mailmate",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "mozilla",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "postbox",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "r2mail2",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "ritlabs srl",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "roundcube",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "the enigmail",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "the horde",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "trojita",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "em client",
        "version": null
      },
      {
        "model": "",
        "scope": null,
        "trust": 0.8,
        "vendor": "multiple vendors",
        "version": null
      },
      {
        "model": "round cube webmail",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "roundcube",
        "version": "0"
      },
      {
        "model": "r2mail2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "r2mail2",
        "version": "0"
      },
      {
        "model": "postbox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "postbox",
        "version": "0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "52.5.2"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "45.5.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "45.1.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "24.1.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "24.0.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.7"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.6"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.5"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.4"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.3"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.2"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "16.0.2"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "15.0.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "13.0.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "12.0.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.20"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.14"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.13"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.12"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.7"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.5"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.4"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.0.11"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.0.9"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.0.8"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.0.5"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.0.4"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.0.2"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.0.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.024"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.9"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.8"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.6"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.5"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.4"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.19"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.17"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.16"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.15"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.14"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.13"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.12"
      },
      {
        "model": "thunderbird beta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.52"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.5.9"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.5.13"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.5"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.0.8"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.0.7"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.0.6"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.0.5"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.0.2"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.0.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "0.9"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "0.8"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "0.7.3"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "0.7.2"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "0.7.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "0.7"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "0.6"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "9.0.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "9.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "8.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "7.0.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "7.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "6.0.2"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "6.0.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "6.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "6"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "52.5"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "52.4"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "52.3"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "52.2"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "52.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "52"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "5.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "5"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "45.8"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "45.7"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "45.6"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "45.4"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "38.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "32.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "31.8"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "31.7"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "31.6"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "31.5"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "31.4"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "31.3"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "31.2"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "31.1.2"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "31.1.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "31.1.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "31.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "31.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "31"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.3"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.9"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.8"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.6"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.3"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.2"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.19"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.18"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.17"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.16"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.15"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.11"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.10"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.0.7"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.0.6"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.0.3"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.0.10"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "24.8.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "24.8"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "24.7"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "24.6"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "24.5"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "24.4"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "24.3"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "24.2"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "24.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "24.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "23.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.0.23"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.0.22"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.0.21"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.0.20"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.0.18"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.0.11"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.9"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.8"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "16.0.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "16.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "16"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "15.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "15"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "14.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "14"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "13.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "12.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "11.0.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "11.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "10.0.4"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "10.0.3"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "10.0.2"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "10.0.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "10.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.5.0.8"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.5.0.7"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.5.0.5"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.5.0.4"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.5.0.2"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.5.0.14"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.5.0.12"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.5.0.10"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.5.0.1"
      },
      {
        "model": "thunderbird beta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.0.5"
      },
      {
        "model": "outlook",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "20070"
      },
      {
        "model": "project horde imp",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "horde",
        "version": "0"
      },
      {
        "model": "solutions maildroid",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "flipdog",
        "version": "0"
      },
      {
        "model": "enigmail",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "enigmail",
        "version": "0"
      },
      {
        "model": "client em client",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "em",
        "version": "0"
      },
      {
        "model": "mail",
        "scope": null,
        "trust": 0.3,
        "vendor": "apple",
        "version": null
      },
      {
        "model": "airmail",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "airmail",
        "version": "0"
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#122919"
      },
      {
        "db": "BID",
        "id": "104162"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-012995"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201712-725"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-17688"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:outlook:2007:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:horde:horde_imp:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:flipdogsolutions:maildroid:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:r2mail2:r2mail2:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apple:mail:-:*:*:*:*:iphone_os:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:bloop:airmail:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:freron:mailmate:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apple:mail:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:thunderbird:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:emclient:emclient:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:postbox-inc:postbox:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:roundcube:webmail:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-17688"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Damian Poddebniak, Christian Dresen, Jens M\u00fcller, Fabian Ising, Sebastian Schinzel, Simon Friedberger, Juraj Somorovsky, and Jorg Schwenk.",
    "sources": [
      {
        "db": "BID",
        "id": "104162"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2017-17688",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "VHN-108735",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULMON",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "CVE-2017-17688",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "MEDIUM",
            "trust": 0.1,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.2,
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2017-17688",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201712-725",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-108735",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2017-17688",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-108735"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-17688"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201712-725"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-17688"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification. In multiple mail clients OpenPGP and S/MIME A plaintext message may be leaked when decrypting the message. OpenPGP and S/MIME For e-mail clients that support, it is possible to establish a channel for sending plaintext by decrypting encrypted e-mail inserted with content crafted by an attacker with the user\u0027s e-mail client. The discoverer can attack with this vulnerability \"CBC/CFB gadget attack\" I call it. For example HTML image By inserting a tag, the decrypted message is HTTP It may be sent as part of the request. * *CVE-2017-17688: OpenPGP CFB Attacks * *CVE-2017-17689: S/MIME CBC Attacks Some email clients also use multipart MIME Because the message is not properly separated and processed, attackers can process encrypted mail in plain text. MIME It can be included in the part. in this case, CBC/CFB gadget attack The plaintext message may be sent without executing. Detail is, \u003ca href=\"https://efail.de/efail-attack-paper.pdf\" target=\"blank\"\u003e Articles provided by the discoverer \u003c/a\u003e Please refer to.A remote attacker may obtain plaintext from encrypted mail without the key information required for decryption. OpenPGP is prone to an information disclosure vulnerability. \nAn attacker can exploit this issue to perform man-in-the-middle attacks and obtain sensitive information. Successful exploits will lead to other attacks. OpenPGP is a set of email encryption standards that supports multiple platforms",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-17688"
      },
      {
        "db": "CERT/CC",
        "id": "VU#122919"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-012995"
      },
      {
        "db": "BID",
        "id": "104162"
      },
      {
        "db": "VULHUB",
        "id": "VHN-108735"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-17688"
      }
    ],
    "trust": 2.79
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2017-17688",
        "trust": 2.9
      },
      {
        "db": "BID",
        "id": "104162",
        "trust": 2.1
      },
      {
        "db": "CERT/CC",
        "id": "VU#122919",
        "trust": 2.0
      },
      {
        "db": "SECTRACK",
        "id": "1040904",
        "trust": 1.8
      },
      {
        "db": "JVN",
        "id": "JVNVU95575473",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-012995",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201712-725",
        "trust": 0.7
      },
      {
        "db": "VULHUB",
        "id": "VHN-108735",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-17688",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#122919"
      },
      {
        "db": "VULHUB",
        "id": "VHN-108735"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-17688"
      },
      {
        "db": "BID",
        "id": "104162"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-012995"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201712-725"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-17688"
      }
    ]
  },
  "id": "VAR-201805-0227",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-108735"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-05-17T19:19:57.881000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Debian CVElist Bug Report Logs: enigmail: efail attack against enigmail",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=56a8018aac811c8d81b81ef5a6c3623a"
      },
      {
        "title": "Red Hat: CVE-2017-17688",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=cve-2017-17688"
      },
      {
        "title": "Efail-malleability-gadget-exploit",
        "trust": 0.1,
        "url": "https://github.com/jaads/efail-malleability-gadget-exploit "
      },
      {
        "title": "more\nBoring bugs",
        "trust": 0.1,
        "url": "https://github.com/hannob/pgpbugs "
      },
      {
        "title": "SecDB - Security Feeds",
        "trust": 0.1,
        "url": "https://github.com/giterlizzi/secdb-feeds "
      },
      {
        "title": "The Register",
        "trust": 0.1,
        "url": "https://www.theregister.co.uk/2018/05/14/smime_pgp_encryption_flaw_emails_vulnerable_to_snooping/"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2017-17688"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-noinfo",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-310",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-108735"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-17688"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.9,
        "url": "https://efail.de/"
      },
      {
        "trust": 1.8,
        "url": "http://www.securityfocus.com/bid/104162"
      },
      {
        "trust": 1.8,
        "url": "https://www.synology.com/support/security/synology_sa_18_22"
      },
      {
        "trust": 1.8,
        "url": "http://flaked.sockpuppet.org/2018/05/16/a-unified-timeline.html"
      },
      {
        "trust": 1.8,
        "url": "https://efail.de"
      },
      {
        "trust": 1.8,
        "url": "https://lists.gnupg.org/pipermail/gnupg-users/2018-may/060334.html"
      },
      {
        "trust": 1.8,
        "url": "https://news.ycombinator.com/item?id=17066419"
      },
      {
        "trust": 1.8,
        "url": "https://protonmail.com/blog/pgp-vulnerability-efail"
      },
      {
        "trust": 1.8,
        "url": "https://twitter.com/matthew_d_green/status/995996706457243648"
      },
      {
        "trust": 1.8,
        "url": "https://www.patreon.com/posts/cybersecurity-15-18814817"
      },
      {
        "trust": 1.8,
        "url": "http://www.securitytracker.com/id/1040904"
      },
      {
        "trust": 1.6,
        "url": "https://efail.de/efail-attack-paper.pdf"
      },
      {
        "trust": 1.2,
        "url": "https://www.kb.cert.org/vuls/id/122919"
      },
      {
        "trust": 0.8,
        "url": "https://tools.ietf.org/html/rfc4880"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-17689"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-17688"
      },
      {
        "trust": 0.8,
        "url": "https://jvn.jp/vu/jvnvu95575473/"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-17689"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-17688"
      },
      {
        "trust": 0.3,
        "url": "https://www.openpgp.org/"
      },
      {
        "trust": 0.3,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1577906"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2017-17688"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/.html"
      },
      {
        "trust": 0.1,
        "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=898630"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/jaads/efail-malleability-gadget-exploit"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#122919"
      },
      {
        "db": "VULHUB",
        "id": "VHN-108735"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-17688"
      },
      {
        "db": "BID",
        "id": "104162"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-012995"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201712-725"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-17688"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CERT/CC",
        "id": "VU#122919"
      },
      {
        "db": "VULHUB",
        "id": "VHN-108735"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-17688"
      },
      {
        "db": "BID",
        "id": "104162"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-012995"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201712-725"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-17688"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-05-14T00:00:00",
        "db": "CERT/CC",
        "id": "VU#122919"
      },
      {
        "date": "2018-05-16T00:00:00",
        "db": "VULHUB",
        "id": "VHN-108735"
      },
      {
        "date": "2018-05-16T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-17688"
      },
      {
        "date": "2018-05-14T00:00:00",
        "db": "BID",
        "id": "104162"
      },
      {
        "date": "2018-05-16T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-012995"
      },
      {
        "date": "2017-12-18T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201712-725"
      },
      {
        "date": "2018-05-16T19:29:00.223000",
        "db": "NVD",
        "id": "CVE-2017-17688"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-05-15T00:00:00",
        "db": "CERT/CC",
        "id": "VU#122919"
      },
      {
        "date": "2019-10-03T00:00:00",
        "db": "VULHUB",
        "id": "VHN-108735"
      },
      {
        "date": "2023-11-07T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-17688"
      },
      {
        "date": "2018-05-15T10:00:00",
        "db": "BID",
        "id": "104162"
      },
      {
        "date": "2018-08-30T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-012995"
      },
      {
        "date": "2019-10-23T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201712-725"
      },
      {
        "date": "2024-05-17T01:16:13.807000",
        "db": "NVD",
        "id": "CVE-2017-17688"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201712-725"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "OpenPGP and S/MIME mail client vulnerabilities",
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#122919"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "encryption problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201712-725"
      }
    ],
    "trust": 0.6
  }
}

VAR-201805-0228

Vulnerability from variot - Updated: 2024-02-13 20:51

The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. In multiple mail clients OpenPGP and S/MIME A plaintext message may be leaked when decrypting the message. OpenPGP and S/MIME For e-mail clients that support, it is possible to establish a channel for sending plaintext by decrypting encrypted e-mail inserted with content crafted by an attacker with the user's e-mail client. The discoverer can attack with this vulnerability "CBC/CFB gadget attack" I call it. For example HTML image By inserting a tag, the decrypted message is HTTP It may be sent as part of the request. * CVE-2017-17688: OpenPGP CFB Attacks * CVE-2017-17689: S/MIME CBC Attacks Some email clients also use multipart MIME Because the message is not properly separated and processed, attackers can process encrypted mail in plain text. MIME It can be included in the part. in this case, CBC/CFB gadget attack The plaintext message may be sent without executing. Detail is, Articles provided by the discoverer Please refer to.A remote attacker may obtain plaintext from encrypted mail without the key information required for decryption. An attacker can exploit this issue to perform man-in-the-middle attacks and obtain sensitive information. Successful exploits will lead to other attacks. S/MIME is a certificate implementation for email encryption. A security vulnerability exists in S/MIME. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

Debian Security Advisory DSA-4244-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff July 13, 2018 https://www.debian.org/security/faq

Package : thunderbird CVE ID : CVE-2017-17689 CVE-2018-5188 CVE-2018-12359 CVE-2018-12360 CVE-2018-12362 CVE-2018-12363 CVE-2018-12364 CVE-2018-12365 CVE-2018-12366 CVE-2018-12372 CVE-2018-12373 CVE-2018-12374

Multiple security issues have been found in Thunderbird, which may lead to the execution of arbitrary code, denial of service or attacks on encrypted emails.

For the stable distribution (stretch), these problems have been fixed in version 1:52.9.1-1~deb9u1.

We recommend that you upgrade your thunderbird packages.

For the detailed security status of thunderbird please refer to its security tracker page at: https://security-tracker.debian.org/tracker/thunderbird

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAltI+2sACgkQEMKTtsN8 TjZXHRAAgOmSvTwwmmzxRH/4tSSpndZCFCtkHrG5PU5D3XesLGnWpNZk9aINsaU2 ih3fmEKzQgHHfAzK3d9TcGjyiI+PoVuWkVknsVqTrHd+xQtxUs7B/5Pfz5WKiYDJ QJ4NhjTgHHystYa0j2CvK28/ZoPVZgwnc/D051ChTInPWXimJI+TxpsndW/NPuaJ SphoPP34OMO2EARjrKCxiL6NRv6kD4CJv0AgoYfdO0qPXomuA8HpDAH1itd7GbRq yVJoZRnpz9dGjJSM5wyFCc1BIqmA/CMphhmqiRTuFBA+rOSEDblzfc2tg9t82CVQ caA7rF3VrYx8qmgpP3akCju+SDOEWLerFGHH1iaQ+GBqiXvduvMl/MSXCZmVZzIC 92Ko2m9kURkak4yKccEbHJ5Vh8i0oLUOc+Ee3MUUfWUblYbCcB4z34p9hRwc8u83 mmGUbsq+qWvdcd9NkekKC/ENQZt4Egb3doeEzqSkaa4uhFaQ1gGosHXGslNTCqLl 6RyeFON9Q5CWphQET+rmnlcJ8B1cSHgpG1ZTN6szlsQpiVgcRu/JYrgyzX9Y6WdY rAape6t+gsEeLOP7n9pZ/KYSadUF5CvYY/nX9H6kJO1RmG9y0A+8wAEuW+nSOMMJ vh2U09+y5XJHQqV0MMTKbnadxlyi8Oerc0zrYaoBuYhR7wmvkus= =R2OH -----END PGP SIGNATURE-----

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201805-0228",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "the bat",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "ritlabs",
        "version": null
      },
      {
        "model": "outlook",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "microsoft",
        "version": "2013"
      },
      {
        "model": "outlook",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "2007"
      },
      {
        "model": "kmail",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "kde",
        "version": null
      },
      {
        "model": "maildroid",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "flipdogsolutions",
        "version": null
      },
      {
        "model": "imp",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "horde",
        "version": null
      },
      {
        "model": "notes",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "ibm",
        "version": null
      },
      {
        "model": "outlook",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "2010"
      },
      {
        "model": "trojita",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "kde",
        "version": null
      },
      {
        "model": "emclient",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "emclient",
        "version": null
      },
      {
        "model": "outlook",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "microsoft",
        "version": "2016"
      },
      {
        "model": "gmail",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "google",
        "version": null
      },
      {
        "model": "mailmate",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "freron",
        "version": null
      },
      {
        "model": "mail",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": null
      },
      {
        "model": "airmail",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "bloop",
        "version": null
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "mozilla",
        "version": null
      },
      {
        "model": "postbox",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "postbox",
        "version": null
      },
      {
        "model": "evolution",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "gnome",
        "version": null
      },
      {
        "model": "nine",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "9folders",
        "version": null
      },
      {
        "model": "r2mail2",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "r2mail2",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "9folders",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "airmail",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "apple",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "evolution",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "flipdog",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "gpgtools",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "gnupg",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "google",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "ibm",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "kmail",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "mailmate",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "microsoft",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "mozilla",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "postbox",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "r2mail2",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "ritlabs srl",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "roundcube",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "the enigmail",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "the horde",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "trojita",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "em client",
        "version": null
      },
      {
        "model": "",
        "scope": null,
        "trust": 0.8,
        "vendor": "multiple vendors",
        "version": null
      },
      {
        "model": "r2mail2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "r2mail2",
        "version": "0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "52.5.2"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "45.5.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "45.1.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "24.1.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "24.0.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.7"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.6"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.5"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.4"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.3"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.2"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "16.0.2"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "15.0.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "13.0.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "12.0.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.20"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.14"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.13"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.12"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.7"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.5"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.4"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.0.11"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.0.9"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.0.8"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.0.5"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.0.4"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.0.2"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.0.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.024"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.9"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.8"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.6"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.5"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.4"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.19"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.17"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.16"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.15"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.14"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.13"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.12"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.5.9"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.5"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.0.8"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.0.7"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.0.6"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.0.5"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.0.2"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.0.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "0.9"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "0.8"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "0.7.3"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "0.7.2"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "0.7.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "0.7"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "0.6"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "7.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "52.5"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "52.4"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "52.3"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "52.2"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "52.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "52"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "5"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "45.8"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "45.7"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "45.6"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "45.4"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "38.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "32.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "31.8"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "31.7"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "31.6"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "31.5"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "31.4"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "31.3"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "31.2"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "31.1.2"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "31.1.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "31.1.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "31.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "31.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "31"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.3"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.9"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.8"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.6"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.3"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.2"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.19"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.18"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.17"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.16"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.15"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.11"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.10"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.0.7"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.0.6"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.0.3"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.0.10"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "3.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "24.8.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "24.8"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "24.7"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "24.6"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "24.5"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "24.4"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "24.3"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "24.2"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "24.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "24.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "23.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.0.23"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.0.22"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.0.21"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.0.20"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.0.18"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "2.0.0.11"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.9"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0.8"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "17.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "16.0.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "16.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "16"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "15.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "15"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "14.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "14"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "13.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "12.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "11.0.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "11.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "10.0.4"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "10.0.3"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "10.0.2"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "10.0.1"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "10.0"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.5.0.8"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.5.0.7"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.5.0.5"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.5.0.4"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.5.0.2"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.5.0.14"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.5.0.12"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.5.0.10"
      },
      {
        "model": "thunderbird",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mozilla",
        "version": "1.5.0.1"
      },
      {
        "model": "outlook",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "20100"
      },
      {
        "model": "outlook",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "20070"
      },
      {
        "model": "kmail",
        "scope": null,
        "trust": 0.3,
        "vendor": "kde",
        "version": null
      },
      {
        "model": "lotus inotes",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": null
      },
      {
        "model": "gmail for ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "google",
        "version": "0"
      },
      {
        "model": "mailmate",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "freron",
        "version": "0"
      },
      {
        "model": "mail",
        "scope": null,
        "trust": 0.3,
        "vendor": "apple",
        "version": null
      },
      {
        "model": "airmail",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "airmail",
        "version": "0"
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#122919"
      },
      {
        "db": "BID",
        "id": "104165"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-012995"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201712-724"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-17689"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:gnome:evolution:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:thunderbird:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ibm:notes:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:emclient:emclient:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:horde:horde_imp:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:9folders:nine:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:freron:mailmate:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:kde:kmail:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ritlabs:the_bat:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:outlook:2013:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:flipdogsolutions:maildroid:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:r2mail2:r2mail2:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apple:mail:-:*:*:*:*:iphone_os:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:bloop:airmail:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:outlook:2010:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:outlook:2007:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:google:gmail:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apple:mail:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:kde:trojita:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:postbox-inc:postbox:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-17689"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Damian Poddebniak, Christian Dresen, Jens Muller, Fabian Ising, Sebastian Schinzel1, Simon Friedberger, Juraj Somorovsky, and Jorg Schwenk",
    "sources": [
      {
        "db": "BID",
        "id": "104165"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2017-17689",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "VHN-108736",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULMON",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "CVE-2017-17689",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "MEDIUM",
            "trust": 0.1,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.2,
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2017-17689",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201712-724",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-108736",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2017-17689",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-108736"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-17689"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201712-724"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-17689"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. In multiple mail clients OpenPGP and S/MIME A plaintext message may be leaked when decrypting the message. OpenPGP and S/MIME For e-mail clients that support, it is possible to establish a channel for sending plaintext by decrypting encrypted e-mail inserted with content crafted by an attacker with the user\u0027s e-mail client. The discoverer can attack with this vulnerability \"CBC/CFB gadget attack\" I call it. For example HTML image By inserting a tag, the decrypted message is HTTP It may be sent as part of the request. * *CVE-2017-17688: OpenPGP CFB Attacks * *CVE-2017-17689: S/MIME CBC Attacks Some email clients also use multipart MIME Because the message is not properly separated and processed, attackers can process encrypted mail in plain text. MIME It can be included in the part. in this case, CBC/CFB gadget attack The plaintext message may be sent without executing. Detail is, \u003ca href=\"https://efail.de/efail-attack-paper.pdf\" target=\"blank\"\u003e Articles provided by the discoverer \u003c/a\u003e Please refer to.A remote attacker may obtain plaintext from encrypted mail without the key information required for decryption. \nAn attacker can exploit this issue to perform man-in-the-middle attacks and obtain sensitive information. Successful exploits will lead to other attacks. S/MIME is a certificate implementation for email encryption. A security vulnerability exists in S/MIME. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4244-1                   security@debian.org\nhttps://www.debian.org/security/                       Moritz Muehlenhoff\nJuly 13, 2018                         https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage        : thunderbird\nCVE ID         : CVE-2017-17689 CVE-2018-5188 CVE-2018-12359 CVE-2018-12360 \n                 CVE-2018-12362 CVE-2018-12363 CVE-2018-12364 CVE-2018-12365 \n                 CVE-2018-12366 CVE-2018-12372 CVE-2018-12373 CVE-2018-12374\n\nMultiple security issues have been found in Thunderbird, which may lead\nto the execution of arbitrary code, denial of service or attacks on\nencrypted emails. \n\nFor the stable distribution (stretch), these problems have been fixed in\nversion 1:52.9.1-1~deb9u1. \n\nWe recommend that you upgrade your thunderbird packages. \n\nFor the detailed security status of thunderbird please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/thunderbird\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAltI+2sACgkQEMKTtsN8\nTjZXHRAAgOmSvTwwmmzxRH/4tSSpndZCFCtkHrG5PU5D3XesLGnWpNZk9aINsaU2\nih3fmEKzQgHHfAzK3d9TcGjyiI+PoVuWkVknsVqTrHd+xQtxUs7B/5Pfz5WKiYDJ\nQJ4NhjTgHHystYa0j2CvK28/ZoPVZgwnc/D051ChTInPWXimJI+TxpsndW/NPuaJ\nSphoPP34OMO2EARjrKCxiL6NRv6kD4CJv0AgoYfdO0qPXomuA8HpDAH1itd7GbRq\nyVJoZRnpz9dGjJSM5wyFCc1BIqmA/CMphhmqiRTuFBA+rOSEDblzfc2tg9t82CVQ\ncaA7rF3VrYx8qmgpP3akCju+SDOEWLerFGHH1iaQ+GBqiXvduvMl/MSXCZmVZzIC\n92Ko2m9kURkak4yKccEbHJ5Vh8i0oLUOc+Ee3MUUfWUblYbCcB4z34p9hRwc8u83\nmmGUbsq+qWvdcd9NkekKC/ENQZt4Egb3doeEzqSkaa4uhFaQ1gGosHXGslNTCqLl\n6RyeFON9Q5CWphQET+rmnlcJ8B1cSHgpG1ZTN6szlsQpiVgcRu/JYrgyzX9Y6WdY\nrAape6t+gsEeLOP7n9pZ/KYSadUF5CvYY/nX9H6kJO1RmG9y0A+8wAEuW+nSOMMJ\nvh2U09+y5XJHQqV0MMTKbnadxlyi8Oerc0zrYaoBuYhR7wmvkus=\n=R2OH\n-----END PGP SIGNATURE-----\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-17689"
      },
      {
        "db": "CERT/CC",
        "id": "VU#122919"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-012995"
      },
      {
        "db": "BID",
        "id": "104165"
      },
      {
        "db": "VULHUB",
        "id": "VHN-108736"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-17689"
      },
      {
        "db": "PACKETSTORM",
        "id": "148553"
      }
    ],
    "trust": 2.88
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2017-17689",
        "trust": 3.0
      },
      {
        "db": "BID",
        "id": "104165",
        "trust": 2.1
      },
      {
        "db": "CERT/CC",
        "id": "VU#122919",
        "trust": 2.0
      },
      {
        "db": "JVN",
        "id": "JVNVU95575473",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-012995",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201712-724",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "148553",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-108736",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-17689",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#122919"
      },
      {
        "db": "VULHUB",
        "id": "VHN-108736"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-17689"
      },
      {
        "db": "BID",
        "id": "104165"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-012995"
      },
      {
        "db": "PACKETSTORM",
        "id": "148553"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201712-724"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-17689"
      }
    ]
  },
  "id": "VAR-201805-0228",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-108736"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-02-13T20:51:14.099000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Red Hat: CVE-2017-17689",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=cve-2017-17689"
      },
      {
        "title": "Efail-malleability-gadget-exploit",
        "trust": 0.1,
        "url": "https://github.com/jaads/efail-malleability-gadget-exploit "
      },
      {
        "title": "SecDB - Security Feeds",
        "trust": 0.1,
        "url": "https://github.com/giterlizzi/secdb-feeds "
      },
      {
        "title": "The Register",
        "trust": 0.1,
        "url": "https://www.theregister.co.uk/2018/05/14/smime_pgp_encryption_flaw_emails_vulnerable_to_snooping/"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2017-17689"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-noinfo",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-310",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-108736"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-17689"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.9,
        "url": "https://efail.de/"
      },
      {
        "trust": 1.9,
        "url": "https://efail.de/efail-attack-paper.pdf"
      },
      {
        "trust": 1.8,
        "url": "http://www.securityfocus.com/bid/104165"
      },
      {
        "trust": 1.8,
        "url": "https://www.synology.com/support/security/synology_sa_18_22"
      },
      {
        "trust": 1.8,
        "url": "https://efail.de"
      },
      {
        "trust": 1.8,
        "url": "https://news.ycombinator.com/item?id=17066419"
      },
      {
        "trust": 1.8,
        "url": "https://pastebin.com/gncc8aym"
      },
      {
        "trust": 1.8,
        "url": "https://twitter.com/matthew_d_green/status/996371541591019520"
      },
      {
        "trust": 1.2,
        "url": "https://www.kb.cert.org/vuls/id/122919"
      },
      {
        "trust": 0.9,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-17689"
      },
      {
        "trust": 0.8,
        "url": "https://tools.ietf.org/html/rfc4880"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-17689"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-17688"
      },
      {
        "trust": 0.8,
        "url": "https://jvn.jp/vu/jvnvu95575473/"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-17688"
      },
      {
        "trust": 0.3,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1577909"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2017-17689"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/.html"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/jaads/efail-malleability-gadget-exploit"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-12362"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-12360"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-12363"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-12365"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-12373"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-5188"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-12366"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-12372"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-12374"
      },
      {
        "trust": 0.1,
        "url": "https://www.debian.org/security/faq"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-12364"
      },
      {
        "trust": 0.1,
        "url": "https://www.debian.org/security/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-12359"
      },
      {
        "trust": 0.1,
        "url": "https://security-tracker.debian.org/tracker/thunderbird"
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#122919"
      },
      {
        "db": "VULHUB",
        "id": "VHN-108736"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-17689"
      },
      {
        "db": "BID",
        "id": "104165"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-012995"
      },
      {
        "db": "PACKETSTORM",
        "id": "148553"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201712-724"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-17689"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CERT/CC",
        "id": "VU#122919"
      },
      {
        "db": "VULHUB",
        "id": "VHN-108736"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-17689"
      },
      {
        "db": "BID",
        "id": "104165"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-012995"
      },
      {
        "db": "PACKETSTORM",
        "id": "148553"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201712-724"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-17689"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-05-14T00:00:00",
        "db": "CERT/CC",
        "id": "VU#122919"
      },
      {
        "date": "2018-05-16T00:00:00",
        "db": "VULHUB",
        "id": "VHN-108736"
      },
      {
        "date": "2018-05-16T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-17689"
      },
      {
        "date": "2018-05-14T00:00:00",
        "db": "BID",
        "id": "104165"
      },
      {
        "date": "2018-05-16T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-012995"
      },
      {
        "date": "2018-07-14T12:12:00",
        "db": "PACKETSTORM",
        "id": "148553"
      },
      {
        "date": "2017-12-18T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201712-724"
      },
      {
        "date": "2018-05-16T19:29:00.303000",
        "db": "NVD",
        "id": "CVE-2017-17689"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-05-15T00:00:00",
        "db": "CERT/CC",
        "id": "VU#122919"
      },
      {
        "date": "2019-10-03T00:00:00",
        "db": "VULHUB",
        "id": "VHN-108736"
      },
      {
        "date": "2019-10-03T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-17689"
      },
      {
        "date": "2018-05-14T00:00:00",
        "db": "BID",
        "id": "104165"
      },
      {
        "date": "2018-08-30T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-012995"
      },
      {
        "date": "2019-10-23T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201712-724"
      },
      {
        "date": "2019-10-03T00:03:26.223000",
        "db": "NVD",
        "id": "CVE-2017-17689"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201712-724"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "OpenPGP and S/MIME mail client vulnerabilities",
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#122919"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "encryption problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201712-724"
      }
    ],
    "trust": 0.6
  }
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

115 vulnerabilities by gnupg

CVE-2026-57062 (GCVE-0-2026-57062)

CVE-2026-41990 (GCVE-0-2026-41990)

CVE-2026-41989 (GCVE-0-2026-41989)

CVE-2026-24883 (GCVE-0-2026-24883)

CVE-2026-24882 (GCVE-0-2026-24882)

CVE-2026-24881 (GCVE-0-2026-24881)

CVE-2025-68973 (GCVE-0-2025-68973)

CVE-2025-68972 (GCVE-0-2025-68972)

CVE-2025-30258 (GCVE-0-2025-30258)

CVE-2022-3219 (GCVE-0-2022-3219)

CVE-2022-3515 (GCVE-0-2022-3515)

CVE-2022-47629 (GCVE-0-2022-47629)

CVE-2022-34903 (GCVE-0-2022-34903)

CVE-2026-41990 (GCVE-0-2026-41990)

CVE-2026-41989 (GCVE-0-2026-41989)

CVE-2026-24883 (GCVE-0-2026-24883)

CVE-2026-24882 (GCVE-0-2026-24882)

CVE-2026-24881 (GCVE-0-2026-24881)

CVE-2025-68973 (GCVE-0-2025-68973)

CVE-2025-68972 (GCVE-0-2025-68972)

CVE-2025-30258 (GCVE-0-2025-30258)

CVE-2022-3219 (GCVE-0-2022-3219)

CVE-2022-3515 (GCVE-0-2022-3515)

CVE-2022-47629 (GCVE-0-2022-47629)

CVE-2022-34903 (GCVE-0-2022-34903)

CVE-2021-40528 (GCVE-0-2021-40528)

GCVE-1-2026-0008

GCVE-1-2026-0001

VAR-201805-0227

VAR-201805-0228

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

115 vulnerabilities by gnupg

CVE-2026-57062 (GCVE-0-2026-57062)

CVE-2026-41990 (GCVE-0-2026-41990)

CVE-2026-41989 (GCVE-0-2026-41989)

CVE-2026-24883 (GCVE-0-2026-24883)

CVE-2026-24882 (GCVE-0-2026-24882)

CVE-2026-24881 (GCVE-0-2026-24881)

CVE-2025-68973 (GCVE-0-2025-68973)

CVE-2025-68972 (GCVE-0-2025-68972)

CVE-2025-30258 (GCVE-0-2025-30258)

CVE-2022-3219 (GCVE-0-2022-3219)

CVE-2022-3515 (GCVE-0-2022-3515)

CVE-2022-47629 (GCVE-0-2022-47629)

CVE-2022-34903 (GCVE-0-2022-34903)

CVE-2026-41990 (GCVE-0-2026-41990)

CVE-2026-41989 (GCVE-0-2026-41989)

CVE-2026-24883 (GCVE-0-2026-24883)

CVE-2026-24882 (GCVE-0-2026-24882)

CVE-2026-24881 (GCVE-0-2026-24881)

CVE-2025-68973 (GCVE-0-2025-68973)

CVE-2025-68972 (GCVE-0-2025-68972)

CVE-2025-30258 (GCVE-0-2025-30258)

CVE-2022-3219 (GCVE-0-2022-3219)

CVE-2022-3515 (GCVE-0-2022-3515)

CVE-2022-47629 (GCVE-0-2022-47629)

CVE-2022-34903 (GCVE-0-2022-34903)

CVE-2021-40528 (GCVE-0-2021-40528)

GCVE-1-2026-0008

GCVE-1-2026-0001

VAR-201805-0227

VAR-201805-0228

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.