mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade gnupg1Upgrade gnupg | Jun 15, 2018 | Jun 8, 2018 |
| Amazon Linux Ami 2 | — | Upgrade gnupg2-debuginfoUpgrade gnupg2Upgrade gnupg2-smime | Apr 27, 2020 | Jun 8, 2018 |
| Amazon_linux | — | Upgrade gnupg2Upgrade gnupg | Jun 29, 2018 | Jun 8, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 8, 2018 |
| Centos_linux | — | Upgrade gnupg2-smimeUpgrade gnupg2Upgrade gnupg2-debuginfo | Jul 17, 2018 | Jun 8, 2018 |
| Debian | — | Upgrade gnupg2Upgrade enigmailUpgrade gnupg1 | Jun 9, 2018 | Jun 8, 2018 |
| Freebsd | — | Upgrade gnupg1Upgrade gnupg | Jun 9, 2018 | Jun 8, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade gnupg2 | Jul 23, 2018 | Jun 8, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade gnupg2 | Aug 10, 2018 | Jun 8, 2018 |
| Oracle Solaris | — | Upgrade library/security/gpgme to version 1.6.0-0.175.3.34.0.3.0 on Solaris 11.3Upgrade crypto/gnupg to version 2.0.30-0.175.3.34.0.3.0 on Solaris 11.3Upgrade security/pinentry to version 0.7.6-0.175.3.34.0.3.0 on Solaris 11.3Upgrade library/security/libksba to version 1.3.5-0.175.3.34.0.3.0 on Solaris 11.3Upgrade library/security/libassuan to version 2.4.3-0.175.3.34.0.3.0 on Solaris 11.3 | Jul 18, 2018 | Jun 8, 2018 |
| Oracle_linux | — | Upgrade gnupg2-smimeUpgrade gnupg2 | Jul 12, 2018 | Jun 8, 2018 |
| Redhat_linux | — | Upgrade gnupg2-debuginfoUpgrade gnupg2-smimeUpgrade gnupg2No solution exists | Jul 12, 2018 | Jun 8, 2018 |
| Suse | — | Upgrade python3-python-gnupgUpgrade gpg2Upgrade enigmailUpgrade dirmngrUpgrade gpg2-langUpgrade python2-python-gnupg | Jun 16, 2018 | Jun 8, 2018 |
| Ubuntu | — | Upgrade gnupg2Upgrade python3-gnupgUpgrade python-gnupgUpgrade python-gnupg (Ubuntu Pro)Upgrade gnupgUpgrade gpgUpgrade python3-gnupg (Ubuntu Pro) | Jun 13, 2018 | Jun 8, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 8, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub