CVE-2019-6690

概述 这是对 python-gnupg 0.4.3 中不当输入验证（CVE-2019-6690）的一个简单 PoC。 受影响版本 python python-gnupg 0.4.3 python python-gnupg 0.3.6 python python-gnupg 0.3.5 python python-gnupg 0.3.4 缓解措施 用户应升级至0.4.4版本。 测试环境 Docker镜像 docker pull avfisherdocker/python-gnupg0.4.3:CVE-2019-6690 docker run -d -p 5000:5000...

CVE-2019-6690-python-gnupg-vulnerability

CVE-2019-6690：python-gnupg 0.4.3 中的输入验证不当 我们发现在使用对称加密时，可以通过 gnupg.GPG.encrypt 和 gnupg.GPG.decrypt 方法的 passphrase 属性注入数据。 所提供的密码短语未经过换行符验证，库会将 --passphrase-fd=0 传递给 gpg 可执行文件，gpg 期望密码短语位于 标准输入的第一行，而要解密的密文或要加密的 明文则位于后续行。 通过提供包含换行符的密码短语，攻击者可以 控制/修改正在解密/加密的密文/明文。 受影响版本 python-gnupg 0.4.3，可能还包括更早的版本...

EUVD-2014-0089

Malware in sbrugna...

EUVD-2014-0087

Malware in sbrugna...

EUVD-2014-0090

Malware in sbrugna...

SUSE CVE-2014-1929

python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection through positional arguments." NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323...

Ubuntu 16.04 ESM : python-gnupg vulnerabilities (USN-4839-1)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4839-1 advisory. Marcus Brinkmann discovered that python-gnupg improperly handled certain command line parameters. A remote attacker could use this to spoof the output of...

SUSE CVE-2013-7323

python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors...

SUSE CVE-2014-1927

The shellquote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$" command-substitution sequences, a different vulnerability than CVE-2014-1928...

SUSE CVE-2014-1928

The shellquote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "" backslash characters to form multi-command sequences, a different...

SUSE CVE-2019-6690

python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting...

Ubuntu: Security Advisory (USN-4839-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2019-0105)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-2862-1 : python-gnupg - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2862 advisory. - mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output...

DLA-2862-1 python-gnupg - security update

Bulletin has no description...

Debian: Security Advisory (DLA-2862-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4839-1 python-gnupg vulnerabilities

Marcus Brinkmann discovered that python-gnupg improperly handled certain command line parameters. A remote attacker could use this to spoof the output of python-gnupg and cause unsigned e-mail to appear signed. CVE-2018-12020 It was discovered that python-gnupg incorrectly handled the GPG...

USN-4839-1: python-gnupg vulnerabilities

Marcus Brinkmann discovered that python-gnupg improperly handled certain command line parameters. A remote attacker could use this to spoof the output of python-gnupg and cause unsigned e-mail to appear signed. CVE-2018-12020 It was discovered that python-gnupg incorrectly handled the GPG...

Fedora: Security Advisory for python-gnupg (FEDORA-2020-17fb3273b2)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for python-gnupg (FEDORA-2020-e67d007a67)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...