SUSE CVE-2018-10859

git-annex is vulnerable to an Information Exposure when decrypting files. A malicious server for a special remote could trick git-annex into decrypting a file that was encrypted to the user's gpg key. This attack could be used to expose encrypted data that was never stored in git-annex...

SUSE CVE-2018-1000071

roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity...

SUSE CVE-2019-11627

gpg-key2ps in signing-party 1.1.x and 2.x before 2.10-1 contains an unsafe shell call enabling shell injection via a User ID...

SUSE CVE-2020-14365

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disablegpgcheck is set to False, which is the default behavior. This flaw...

Design/Logic Flaw

A vulnerability was found in Freedom of the Press SecureDrop. It has been rated as critical. Affected by this issue is some unknown functionality of the file gpg-agent.conf. The manipulation leads to symlink following. Local access is required to approach this attack. The name of the patch is...

CVE-2022-4563 Freedom of the Press SecureDrop gpg-agent.conf symlink

A vulnerability was found in Freedom of the Press SecureDrop. It has been rated as critical. Affected by this issue is some unknown functionality of the file gpg-agent.conf. The manipulation leads to symlink following. Local access is required to approach this attack. The name of the patch is...

CVE-2022-4563 Freedom of the Press SecureDrop gpg-agent.conf symlink

A vulnerability was found in Freedom of the Press SecureDrop. It has been rated as critical. Affected by this issue is some unknown functionality of the file gpg-agent.conf. The manipulation leads to symlink following. Local access is required to approach this attack. The name of the patch is...

CVE-2022-4563

CVE-2022-4563 affects Freedom of the Press SecureDrop. The issue concerns an unknown functionality in gpg-agent.conf where manipulation enables symlink following. Local access is required to exploit. A patch identified as b0526a06f8ca713cce74b63e00d3730618d89691 is available, and applying it is r...

CVE-2022-4563 Freedom of the Press SecureDrop gpg-agent.conf symlink

A vulnerability was found in Freedom of the Press SecureDrop. It has been rated as critical. Affected by this issue is some unknown functionality of the file gpg-agent.conf. The manipulation leads to symlink following. Local access is required to approach this attack. The name of the patch is...

containers-common bug fix and enhancement update

An update is available for containers-common. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The containers-common package contains common configuration files a...

CLSA-2022-1668118081 Fix CVE(s): CVE-2020-16156

SECURITY UPDATE: Signature verification bypass - debian/patches/fixes/CVE-2020-16156.patch: recognize CANNOTVERIFY signature verification type, add two new failure modes based on 'cpanpath' and improve interaction with external 'gpg' executable. - CVE-2020-16156...

CVE-2022-35132

Usermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module...

Command injection

Usermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module...

CVE-2022-35132

Usermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module...

CVE-2022-35132

The CVE-2022-35132 vulnerability affects Webmin/Usermin (up to version 1.850). It allows a remote authenticated user to execute OS commands via command injection in a filename used by the GPG module. Root cause: improper handling of the GPG module filename enables command execution. Impact is hig...

CVE-2022-35132

Usermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module...

PT-2022-22590 · Usermin · Usermin

Name of the Vulnerable Software and Affected Versions: Usermin versions prior to 1.851 Description: The issue allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module. Recommendations: For versions prior to 1.851, update to version 1.851 or...

CVE-2022-35132

Usermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module...

gnutls and nettle security, bug fix, and enhancement update

gnutls 3.7.6-12 - fips: mark PBKDF2 with short key and output sizes non-approved - fips: only mark HMAC as approved in PBKDF2 - fips: mark gnutlskeygenerate with short key sizes non-approved - fips: fix checking on hash algorithm used in ECDSA - fips: preserve operation context around FIPS...

Moderate: Red Hat Security Advisory: gnupg2 security update

An update for gnupg2 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...