CVSS: 3.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-3219
https://notcve.org/view.php?id=CVE-2022-3219
GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB. • https://access.redhat.com/security/cve/CVE-2022-3219 https://bugzilla.redhat.com/show_bug.cgi?id=2127010 https://dev.gnupg.org/D556 https://dev.gnupg.org/T5993 https://marc.info/?l=oss-security&m=165696590211434&w=4 https://security.netapp.com/advisory/ntap-20230324-0001 • CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-47629 – libksba: integer overflow to code execution
https://notcve.org/view.php?id=CVE-2022-47629
Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. Libksba anterior a 1.6.3 es propenso a sufrir una vulnerabilidad de desbordamiento de enteros en el analizador de firmas CRL. A vulnerability was found in the Libksba library, due to an integer overflow within the CRL's signature parser. This issue can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment. • https://dev.gnupg.org/T6284 https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git%3Ba=commit%3Bh=f61a5ea4e0f6a80fd4b28ef0174bee77793cf070 https://lists.debian.org/debian-lts-announce/2022/12/msg00035.html https://security.gentoo.org/glsa/202212-07 https://security.netapp.com/advisory/ntap-20230316-0011 https://www.debian.org/security/2022/dsa-5305 https://access.redhat.com/security/cve/CVE-2022-47629 https://bugzilla.redhat.com/show_bug.cgi?id=2161571 • CWE-190: Integer Overflow or Wraparound •
CVSS: 9.8EPSS: 1%CPEs: 5EXPL: 2CVE-2022-3515 – GnuPG libksba CRL File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-3515
A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GnuPG libksba. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of CRL files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. • https://access.redhat.com/security/cve/CVE-2022-3515 https://bugzilla.redhat.com/show_bug.cgi?id=2135610 https://dev.gnupg.org/rK4b7d9cd4a018898d7714ce06f3faf2626c14582b https://security.netapp.com/advisory/ntap-20230706-0008 https://www.gnupg.org/blog/20221017-pepe-left-the-ksba.html • CWE-190: Integer Overflow or Wraparound •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 2CVE-2022-34903 – gpg: Signature spoofing via status line injection
https://notcve.org/view.php?id=CVE-2022-34903
GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line. GnuPG versiones hasta 2.3.6, en situaciones inusuales en las que un atacante posee cualquier información de clave secreta del llavero de la víctima y son cumplidos en otras restricciones (por ejemplo, el uso de GPGME), permite una falsificación de firmas por medio de la inyección en la línea de estado A vulnerability was found in GnuPG. This issue occurs due to an escape detection loop at the write_status_text_and_buffer() function in g10/cpr.c. This flaw allows a malicious actor to bypass access control. • http://www.openwall.com/lists/oss-security/2022/07/02/1 https://bugs.debian.org/1014157 https://dev.gnupg.org/T6027 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRLWJQ76A4UKHI3Q36BKSJKS4LFLQO33 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPTAR76EIZY7NQFENSOZO7U473257OVZ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VN63GBTMRWO36Y7BKA2WQHROAKCXKCBL https://lists.fedoraproject.org/archives • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 1CVE-2021-40528 – libgcrypt: ElGamal implementation allows plaintext recovery
https://notcve.org/view.php?id=CVE-2021-40528
The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP. Una implementación de ElGamal en Libgcrypt versiones anteriores a 1.9.4, permite una recuperación de texto plano porque, durante la interacción entre dos bibliotecas criptográficas, una determinada combinación peligrosa del primo definido por la clave pública del receptor, el generador definido por la clave pública del receptor y los exponentes efímeros del emisor puede conllevar a un ataque de configuración cruzada contra OpenPGP. A flaw was found in libgcrypt's ElGamal implementation, where it allows plain text recovery. During the interaction between two cryptographic libraries, a certain combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP. The highest threat from this vulnerability is to confidentiality. • https://eprint.iacr.org/2021/923 https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=3462280f2e23e16adf3ed5176e0f2413d8861320 https://ibm.github.io/system-security-research-updates/2021/07/20/insecurity-elgamal-pt1 https://ibm.github.io/system-security-research-updates/2021/09/06/insecurity-elgamal-pt2 https://security.gentoo.org/glsa/202210-13 https://access.redhat.com/security/cve/CVE-2021-40528 https://bugzilla.redhat.com/show_bug.cgi?id=2002816 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •