CVEvulnerability

CVE-2019-6690

7.5 HIGH Published 2019-03-21 Modified 2026-06-17 Official page ↗

Status: Modified
Published: 2019-03-21
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected]): 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses: CWE-20

Description

python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting the affect functionality component.

Affected configurations

• python python-gnupg 0.4.3 • debian debian linux 8.0 • debian debian linux 9.0 • opensuse leap 15.0 • suse backports • canonical ubuntu linux 18.04 • canonical ubuntu linux 18.10 • canonical ubuntu linux 19.04

Weakness · CWE (1)

CWE-20 Improper Input Validation weakness

References

http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00008.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00058.html Mailing List, Third Party Advisory
http://packetstormsecurity.com/files/151341/Python-GnuPG-0.4.3-Improper-Input-Validation.html Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/106756 Broken Link
https://blog.hackeriet.no/cve-2019-6690-python-gnupg-vulnerability/ Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/02/msg00021.html Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00027.html Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WMV6XNPPL3VB3RQRFFOBCJ3AGWC4K47/ lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6KYZMN2PWXY4ENZVJUVTGFBVYEVY7II/ lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4VFRUG56542LTYK4444TPJBGR57MT25/ lists.fedoraproject.org
https://pypi.org/project/python-gnupg/#history Product, Third Party Advisory
https://seclists.org/bugtraq/2019/Jan/41 Mailing List, Third Party Advisory
https://usn.ubuntu.com/3964-1/ Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00008.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00058.html Mailing List, Third Party Advisory
http://packetstormsecurity.com/files/151341/Python-GnuPG-0.4.3-Improper-Input-Validation.html Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/106756 Broken Link
https://blog.hackeriet.no/cve-2019-6690-python-gnupg-vulnerability/ Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/02/msg00021.html Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00027.html Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WMV6XNPPL3VB3RQRFFOBCJ3AGWC4K47/ lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6KYZMN2PWXY4ENZVJUVTGFBVYEVY7II/ lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4VFRUG56542LTYK4444TPJBGR57MT25/ lists.fedoraproject.org
https://pypi.org/project/python-gnupg/#history Product, Third Party Advisory
https://seclists.org/bugtraq/2019/Jan/41 Mailing List, Third Party Advisory
https://usn.ubuntu.com/3964-1/ Third Party Advisory