CVE-2019-6690

요약 python-gnupg 0.4.3의 부적절한 입력 검증Improper Input Validation에 대한 간단한 PoC입니다. CVE-2019-6690 취약 버전 python python-gnupg 0.4.3 python python-gnupg 0.3.6 python python-gnupg 0.3.5 python python-gnupg 0.3.4 완화 방법 사용자는 0.4.4로 업그레이드해야 합니다. 테스트 환경 Docker 이미지 docker pull...

CVE-2019-6690-python-gnupg-vulnerability

CVE-2019-6690: python-gnupg 0.4.3의 부적절한 입력 검증 우리는 대칭 암호화를 사용할 때 gnupg.GPG.encrypt 및 gnupg.GPG.decrypt 메서드의 passphrase 속성을 통해 데이터를 주입할 수 있는 방법을 발견했습니다. 제공된 패스프레이즈는 개행 문자에 대해 검증되지 않으며, 라이브러리는 gpg 실행 파일에 --passphrase-fd=0을 전달합니다. gpg 실행 파일은 stdin의 첫 번째 줄에서 패스프레이즈를, 이후 줄에서 복호화할 암호문 또는 암호화할 평문을 기대합니다...

OPENSUSE-SU-2026:11755-1 python313-python-gnupg-0.5.6-2.1 on GA media

These are all security issues fixed in the python313-python-gnupg-0.5.6-2.1 package on the GA media of openSUSE Tumbleweed...

EUVD-2014-0089

Malware in sbrugna...

EUVD-2014-0087

Malware in sbrugna...

EUVD-2014-0090

Malware in sbrugna...

SUSE CVE-2014-1929

python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection through positional arguments." NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323...

Ubuntu 16.04 ESM : python-gnupg vulnerabilities (USN-4839-1)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4839-1 advisory. Marcus Brinkmann discovered that python-gnupg improperly handled certain command line parameters. A remote attacker could use this to spoof the output of...

SUSE CVE-2013-7323

python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors...

SUSE CVE-2014-1927

The shellquote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$" command-substitution sequences, a different vulnerability than CVE-2014-1928...

SUSE CVE-2014-1928

The shellquote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "" backslash characters to form multi-command sequences, a different...

SUSE CVE-2019-6690

python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting...

Ubuntu: Security Advisory (USN-4839-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2019-0105)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-2862-1 : python-gnupg - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2862 advisory. - mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output...

DLA-2862-1 python-gnupg - security update

Bulletin has no description...

Debian: Security Advisory (DLA-2862-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4839-1 python-gnupg vulnerabilities

Marcus Brinkmann discovered that python-gnupg improperly handled certain command line parameters. A remote attacker could use this to spoof the output of python-gnupg and cause unsigned e-mail to appear signed. CVE-2018-12020 It was discovered that python-gnupg incorrectly handled the GPG...

USN-4839-1: python-gnupg vulnerabilities

Marcus Brinkmann discovered that python-gnupg improperly handled certain command line parameters. A remote attacker could use this to spoof the output of python-gnupg and cause unsigned e-mail to appear signed. CVE-2018-12020 It was discovered that python-gnupg incorrectly handled the GPG...

Fedora: Security Advisory for python-gnupg (FEDORA-2020-e67d007a67)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...