7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
gnupg2 is vulnerable to spoofable output attacks. The vulnerability exists as mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the “–status-fd 2” option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.
openwall.com/lists/oss-security/2018/06/08/2
packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html
seclists.org/fulldisclosure/2019/Apr/38
www.openwall.com/lists/oss-security/2019/04/30/4
www.securityfocus.com/bid/104450
www.securitytracker.com/id/1041051
access.redhat.com/errata/RHSA-2018:2180
access.redhat.com/errata/RHSA-2018:2181
access.redhat.com/security/updates/classification/#important
dev.gnupg.org/T4012
github.com/RUB-NDS/Johnny-You-Are-Fired
github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf
help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0
lists.debian.org/debian-lts-announce/2021/12/msg00027.html
lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html
usn.ubuntu.com/3675-1/
usn.ubuntu.com/3675-2/
usn.ubuntu.com/3675-3/
usn.ubuntu.com/3964-1/
www.debian.org/security/2018/dsa-4222
www.debian.org/security/2018/dsa-4223
www.debian.org/security/2018/dsa-4224
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N