CVE-2019-6690
Python GnuPG 0.4.3 Improper Input Validation
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
3Exploited in Wild
-Decision
Descriptions
python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting the affect functionality component.
python-gnupg 0.4.3 permite que los atacantes dependientes del contexto engañen a gnupg para descifrar texto cifrado diferente al planeado. Para realizar el ataque, la frase de contraseña para gnupg debe estar controlada por el adversario y el texto cifrado debería ser fiable. Relacionado con un problema CWE-20: validación de entradas incorrecta que afecta al componente de la funcionalidad afectada.
Marcus Brinkmann discovered that GnuPG before 2.2.8 improperly handled certain command line parameters. A remote attacker could use this to spoof the output of GnuPG and cause unsigned e-mail to appear signed. It was discovered that python-gnupg incorrectly handled the GPG passphrase. A remote attacker could send a specially crafted passphrase that would allow them to control the output of encryption and decryption operations. Various other issues were also addressed.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-01-23 CVE Reserved
- 2019-01-25 CVE Published
- 2019-01-25 First Exploit
- 2024-08-04 CVE Updated
- 2025-04-07 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-20: Improper Input Validation
CAPEC
References (16)
| URL | Tag | Source |
|---|---|---|
| http://packetstormsecurity.com/files/151341/Python-GnuPG-0.4.3-Improper-Input-Validation.html | Third Party Advisory |
|
| http://www.securityfocus.com/bid/106756 | Broken Link | |
| https://blog.hackeriet.no/cve-2019-6690-python-gnupg-vulnerability | Third Party Advisory | |
| https://lists.debian.org/debian-lts-announce/2019/02/msg00021.html | Mailing List |
|
| https://lists.debian.org/debian-lts-announce/2021/12/msg00027.html | Mailing List |
|
| https://pypi.org/project/python-gnupg/#history | Product | |
| https://seclists.org/bugtraq/2019/Jan/41 | Mailing List |
|
| URL | Date | SRC |
|---|---|---|
| https://packetstorm.news/files/id/151341 | 2019-01-25 | |
| https://github.com/brianwrf/CVE-2019-6690 | 2019-04-03 | |
| https://github.com/stigtsp/CVE-2019-6690-python-gnupg-vulnerability | 2019-09-21 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Suse Search vendor "Suse" | Backports Search vendor "Suse" for product "Backports" | - | - |
Affected
| in | Suse Search vendor "Suse" | Linux Enterprise Search vendor "Suse" for product "Linux Enterprise" | 15.0 Search vendor "Suse" for product "Linux Enterprise" and version "15.0" | - |
Safe
|
| Python Search vendor "Python" | Python-gnupg Search vendor "Python" for product "Python-gnupg" | 0.4.3 Search vendor "Python" for product "Python-gnupg" and version "0.4.3" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Leap Search vendor "Opensuse" for product "Leap" | 15.0 Search vendor "Opensuse" for product "Leap" and version "15.0" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 18.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "18.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 18.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "18.10" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 19.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "19.04" | - |
Affected
| ||||||