CVE-2019-6690

python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting...

CVE-2019-6690

CVE-2019-6690 affects python-gnupg 0.4.3. A context-dependent flaw lets an attacker, if they control the GnuPG passphrase and the ciphertext is trusted, cause decryption of ciphertext other than intended (CWE-20: Improper Input Validation). Impact described in sources includes manipulation of enc...

gnupg/fuzz_verify: Heap-use-after-free in proc_plaintext

Project: git://git.gnupg.org/gnupg.git Detailed report: https://oss-fuzz.com/testcase?key=5697816893063168 Project: gnupg Fuzzer: libFuzzergnupgfuzzverify Fuzz target binary: fuzzverify Job Type: libfuzzerasangnupg Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address:...

Updated gnupg2 packages fix security vulnerability

GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery CSRF vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Disclosure, DoS. This attack appear to be exploitable via Victim must perform a WKD request, e.g. enter an email address in the composer window...

MGASA-2019-0108 Updated gnupg2 packages fix security vulnerability

GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery CSRF vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Disclosure, DoS. This attack appear to be exploitable via Victim must perform a WKD request, e.g. enter an email address in the composer window...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private Storage - GlusterFS and Minio

Summary Security Vulnerabilities affect IBM Cloud Private Storage - GlusterFS and Minio Vulnerability Details CVEID: CVE-2018-14618 DESCRIPTION: cURL libcurl is vulnerable to a buffer overflow, caused by an integer overflow flaw in the Curlntlmcoremknthash internal function in the NTLM...

EulerOS Virtualization 2.5.2 : gnupg2 (EulerOS-SA-2019-1077)

According to the version of the gnupg2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote...

MGASA-2019-0105 Updated python-gnupg packages fix security vulnerability

When symmetric encryption is used, data can be injected through the passphrase property of the gnupg.GPG.encrypt and gnupg.GPG.decrypt methods. The supplied passphrase is not validated for newlines, and the library passes --passphrase-fd=0 to the gpg executable, which expects the passphrase on th...

Updated python-gnupg packages fix security vulnerability

When symmetric encryption is used, data can be injected through the passphrase property of the gnupg.GPG.encrypt and gnupg.GPG.decrypt methods. The supplied passphrase is not validated for newlines, and the library passes --passphrase-fd=0 to the gpg executable, which expects the passphrase on th...

VSHG - Hardware resistance & enhanced security for GnuPG

VSHG aims to provide a memory / hardware resistant reinforcement to GnuPG's standared s2k key-derivation-function + a simplified interface for symmetric encryption . About VSHG VSHG Very secure hash generator is a standalone Addon for GnuPG Gnu privacy guard . It is written as a shell script and ...

OPENSUSE-SU-2019:0239-1 Security update for python-python-gnupg

This update for python-python-gnupg to version 0.4.4 fixes the following issues: Security issue fixed: - CVE-2019-6690: Added a check to disallow certain control characters '\r', '\n', NUL in passphrases boo1123498. This update was imported from the openSUSE:Leap:15.0:Update update project...

Security update for python-python-gnupg (important)

openSUSE Security Update: Security update for python-python-gnupg Announcement ID: openSUSE-SU-2019:0239-1 Rating: important References: 1123498 Cross-References: CVE-2019-6690 Affected Products: openSUSE Backports SLE-15 An update that fixes one vulnerability is now available. Description: This...

The vulnerability of the Python-gnupg information encryption package lies in insufficient validation of input data, allowing a hacker to execute arbitrary code.

The vulnerability of the gnupg.GPG.encrypt and gnupg.GPG.decrypt methods of the Python-gnupg encryption library exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

Debian DLA-1675-1 : python-gnupg security update

Alexander Kjll and Stig Palmquist discovered a vulnerability in python-gnupg, a wrapper around GNU Privacy Guard. It was possible to inject data through the passphrase property of the gnupg.GPG.encrypt and gnupg.GPG.decrypt functions when symmetric encryption is used. The supplied passphrase is n...

[SECURITY] [DLA 1675-1] python-gnupg security update

Package : python-gnupg Version : 0.3.6-1+deb8u1 CVE ID : CVE-2019-6690 Alexander Kjäll and Stig Palmquist discovered a vulnerability in python-gnupg, a wrapper around GNU Privacy Guard. It was possible to inject data through the passphrase property of the gnupg.GPG.encrypt and gnupg.GPG.decrypt...

DLA-1675-1 python-gnupg - security update

Bulletin has no description...

Debian: Security Advisory (DLA-1675-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Important Photon OS Security Update - PHSA-2019-0207

Updates of 'unzip', 'gnupg' packages of Photon OS have been released...

openSUSE Security Update : python-python-gnupg (openSUSE-2019-143)

This update for python-python-gnupg to version 0.4.4 fixes the following issues : Security issue fixed : - CVE-2019-6690: Added a check to disallow certain control characters '\r', '\n', NUL in passphrases boo1123498. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

openSUSE: Security Advisory for python-python-gnupg (openSUSE-SU-2019:0143-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...