VSHG

VSHG - Hardware resistance & enhanced security for GnuPG. VSHG aims to provide a memory / hardware resistant reinforcement to GnuPG's standared s2k key-derivation-function + a simplified interface for symmetric encryption . About VSHG VSHG Very secure hash generator is a standalone Addon for GnuP...

CVE-2019-6690

Summary It is a simple PoC of Improper Input Validation in python-gnupg 0.4.3 CVE-2019-6690. Vulnerable python python-gnupg 0.4.3 python python-gnupg 0.3.6 python python-gnupg 0.3.5 python python-gnupg 0.3.4 Mitigation Users should upgrade to 0.4.4 Test Environment Docker Image docker pull...

CVE-2019-6690-python-gnupg-vulnerability

CVE-2019-6690: python-gnupg 0.4.3 における不適切な入力検証 我々は、対称暗号化を使用する際に、gnupg.GPG.encrypt および gnupg.GPG.decrypt メソッドのパスフレーズプロパティを介してデータを注入する方法を発見しました。 提供されたパスフレーズは改行に対して検証されておらず、ライブラリは --passphrase-fd=0 を gpg 実行可能ファイルに渡します。gpg は標準入力の最初の行にパスフレーズを、その後の行に復号する暗号文または暗号化する平文を期待します。...

Rocky Linux 9 [CIQ] Security Update: gnupg2 / gnupg2-debuginfo / gnupg2-debugsource / gnupg2-smime / etc (crlsa-2026_0719)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20260719 advisory. GnuPG: GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds write CVE-2025-68973 Tenable has extracted the preceding description...

Rocky Linux 8 [CIQ] Security Update: gnupg2 / gnupg2-debuginfo / gnupg2-debugsource / gnupg2-smime / etc (crlsa-2026_0728)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20260728 advisory. GnuPG: GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds write CVE-2025-68973 Tenable has extracted the preceding description...

Rocky Linux 10.1 [CIQ] Security Update: gnupg2 / gnupg2-debuginfo / gnupg2-debugsource / gnupg2-smime / etc (crlsa-2026_0697)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20260697 advisory. GnuPG: GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds write CVE-2025-68973 Tenable has extracted the preceding descriptio...

CentOS Linux 8.5 [TuxCare] Security Update: gnupg2 / gnupg2-smime (CENTOS8.5:CLSA-2026:1769163825)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1769163825 advisory. - In GnuPG before 2.4.9, armorfilter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bound...

AlmaLinux 9.6 [TuxCare] Security Update: gnupg2 / gnupg2-smime (ALMALINUX9.6:CLSA-2026:1786609750)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786609750 advisory. - CMS Cryptographic Message Syntax parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is...

CentOS Linux 8 [TuxCare] Security Update: gnupg2 / gnupg2-smime (CENTOS-STREAM8:CLSA-2026:1769162862)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1769162862 advisory. - In GnuPG before 2.4.9, armorfilter in g10/armor.c has two increments of an index variable where one is intended, leading to an...

AlmaLinux 9.6 [TuxCare] Security Update: gnupg2 / gnupg2-smime (ALMALINUX9.6:CLSA-2026:1769085200)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1769085200 advisory. - In GnuPG before 2.4.9, armorfilter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bound...

CentOS Linux 8.4 [TuxCare] Security Update: gnupg2 / gnupg2-smime (CENTOS8.4:CLSA-2026:1769163161)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1769163161 advisory. - In GnuPG before 2.4.9, armorfilter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bound...

AlmaLinux 9.6 [TuxCare] Security Update: gnupg2 / gnupg2-smime (ALMALINUX9.6:CLSA-2026:1780512159)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1780512159 advisory. - GnuPG can be made to spin on a relatively small input by for example crafting a public key with thousands of signatures attached, compresse...

ROOT-OS-ALPINE-319-CVE-2025-68973 CVE-2025-68973 in gnupg - Patched by Root

Root has patched CVE-2025-68973 in the gnupg package for Root:Alpine:3.19. Multiple fixed versions available...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gnupg2 (UTSA-2026-090063)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090063 advisory. A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forge...

Linux Distros Unpatched Vulnerability : CVE-2026-52727

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from...

CVE-2026-81180

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image processing to invoke Ghostscript, allowing embedded PostScript to operate in the shared temporary directory. An attacker c...

CVE-2026-81180

SysReptor Professional (a pentest reporting platform) is vulnerable to authenticated remote code execution prior to version 2026.61 . Authenticated users can upload image files in formats that trigger Ghostscript during processing, allowing embedded PostScript to operate within the shared tempora...

CVE-2026-81180 SysReptor: Authenticated RCE by insecure image processing

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image processing to invoke Ghostscript, allowing embedded PostScript to operate in the shared temporary directory. An attacker c...

CVE-2026-81180 SysReptor: Authenticated RCE by insecure image processing

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image processing to invoke Ghostscript, allowing embedded PostScript to operate in the shared temporary directory. An attacker c...

CVE-2026-81180 SysReptor: Authenticated RCE by insecure image processing

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image processing to invoke Ghostscript, allowing embedded PostScript to operate in the shared temporary directory. An attacker c...