Veracode Vulnerability DatabaseVERACODE:27819Denial Of Service (DoS)
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
gnupg2 is vulnerable to denial of service (DoS). This is because the interaction between the sks-keyserver code and GnuPG allows for a Certificate Spamming Attack causing an application crash.
| CPE | Name | Operator | Version |
|---|---|---|---|
| gnupg2 | eq | 2.2.9__1.el8 | |
| gnupg2:bionic | eq | 2.2.4-1ubuntu1.2 | |
| gnupg2:bionic | eq | 2.2.4-1ubuntu1 | |
| gnupg2:bionic | eq | 2.2.4-1ubuntu1.3 |
References
lists.opensuse.org/opensuse-security-announce/2019-08/msg00039.html
access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/
access.redhat.com/errata/RHSA-2020:4490
access.redhat.com/security/updates/classification/#moderate
gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f
lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
lists.fedoraproject.org/archives/list/[email protected]/message/AUK2YRO6QIH64WP2LRA5D4LACTXQPPU4/
lists.fedoraproject.org/archives/list/[email protected]/message/CP4ON34YEXEZDZOXXWV43KVGGO6WZLJ5/
lists.gnupg.org/pipermail/gnupg-announce/2019q3/000439.html
support.f5.com/csp/article/K08654551
support.f5.com/csp/article/K08654551?utm_source=f5support&utm_medium=RSS
twitter.com/lambdafu/status/1147162583969009664
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P