GitHub Advisoryadvisory · PyPI

GHSA-2fch-jvg5-crf6 Improper Input Validation python-gnupg

HIGH Published 2019-03-25 Modified 2022-09-17 Official page ↗
Aliases
CVE-2019-6690
Ecosystem
PyPI
Packages
python-gnupg
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20
Reviewed
2020-06-16

Affected packages

• PyPI python-gnupg: < 0.4.4 → fixed in 0.4.4

Description

python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting the affect functionality component.

Related

Alias · CVE (1)

  • CVE-2019-6690 python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References