CVE-2019-6690
Python GnuPG 0.4.3 Improper Input Validation
Severity Score
7.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
2
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting the affect functionality component.
python-gnupg 0.4.3 permite que los atacantes dependientes del contexto engañen a gnupg para descifrar texto cifrado diferente al planeado. Para realizar el ataque, la frase de contraseña para gnupg debe estar controlada por el adversario y el texto cifrado debería ser fiable. Relacionado con un problema CWE-20: validación de entradas incorrecta que afecta al componente de la funcionalidad afectada.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2019-01-23 CVE Reserved
- 2019-01-25 CVE Published
- 2019-04-03 First Exploit
- 2024-08-04 CVE Updated
- 2024-10-10 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-20: Improper Input Validation
CAPEC
References (15)
| URL | Tag | Source |
|---|---|---|
| http://packetstormsecurity.com/files/151341/Python-GnuPG-0.4.3-Improper-Input-Validation.html | Third Party Advisory |
|
| http://www.securityfocus.com/bid/106756 | Broken Link | |
| https://blog.hackeriet.no/cve-2019-6690-python-gnupg-vulnerability | Third Party Advisory | |
| https://lists.debian.org/debian-lts-announce/2019/02/msg00021.html | Mailing List |
|
| https://lists.debian.org/debian-lts-announce/2021/12/msg00027.html | Mailing List |
|
| https://pypi.org/project/python-gnupg/#history | Product | |
| https://seclists.org/bugtraq/2019/Jan/41 | Mailing List |
|
| URL | Date | SRC |
|---|---|---|
| https://github.com/brianwrf/CVE-2019-6690 | 2019-04-03 | |
| https://github.com/stigtsp/CVE-2019-6690-python-gnupg-vulnerability | 2019-09-21 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Suse Search vendor "Suse" | Backports Search vendor "Suse" for product "Backports" | - | - |
Affected
| in | Suse Search vendor "Suse" | Linux Enterprise Search vendor "Suse" for product "Linux Enterprise" | 15.0 Search vendor "Suse" for product "Linux Enterprise" and version "15.0" | - |
Safe
|
| Python Search vendor "Python" | Python-gnupg Search vendor "Python" for product "Python-gnupg" | 0.4.3 Search vendor "Python" for product "Python-gnupg" and version "0.4.3" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Leap Search vendor "Opensuse" for product "Leap" | 15.0 Search vendor "Opensuse" for product "Leap" and version "15.0" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 18.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "18.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 18.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "18.10" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 19.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "19.04" | - |
Affected
| ||||||