CVEvulnerability
CVE-2020-25125
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-09-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-120
Description
GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker's OpenPGP key, and this key has AEAD preferences. The overflow is caused by a g10/key-check.c error. NOTE: GnuPG 2.3.x is unaffected. GnuPG 2.2.23 is a fixed version.
Affected configurations
• gnupg gnupg 2.2.21
• gnupg gnupg 2.2.22
• gpg4win gpg4win 3.1.12
Related
Weakness · CWE (1)
- CWE-120 Buffer Copy without Checking Size of Input weakness
References
- http://www.openwall.com/lists/oss-security/2020/09/03/4 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2020/09/03/5 Mailing List, Third Party Advisory
- https://bugzilla.opensuse.org/show_bug.cgi?id=1176034 Exploit, Issue Tracking, Third Party Advisory
- https://dev.gnupg.org/T5050 Mailing List
- https://dev.gnupg.org/rG8ec9573e57866dda5efb4677d4454161517484bc Patch, Vendor Advisory
- https://lists.gnupg.org/pipermail/gnupg-announce/2020q3/000448.html Vendor Advisory
- http://www.openwall.com/lists/oss-security/2020/09/03/4 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2020/09/03/5 Mailing List, Third Party Advisory
- https://bugzilla.opensuse.org/show_bug.cgi?id=1176034 Exploit, Issue Tracking, Third Party Advisory
- https://dev.gnupg.org/T5050 Mailing List
- https://dev.gnupg.org/rG8ec9573e57866dda5efb4677d4454161517484bc Patch, Vendor Advisory
- https://lists.gnupg.org/pipermail/gnupg-announce/2020q3/000448.html Vendor Advisory