Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-gnupg2alma-upgrade-gnupg2-smime | May 4, 2022 | Jun 29, 2019 | |
| Centos_linux | — | centos-upgrade-gnupg2centos-upgrade-gnupg2-debuginfocentos-upgrade-gnupg2-debugsourcecentos-upgrade-gnupg2-smimecentos-upgrade-gnupg2-smime-debuginfo | Nov 5, 2020 | Jun 29, 2019 |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-gnupg2huawei-euleros-2_0_sp8-upgrade-gnupg2-smime | Feb 26, 2020 | Jun 29, 2019 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-crypto-gnupg-2-2-17-11-4-16-0-1-3-0 | Dec 18, 2019 | Jun 29, 2019 | |
| Oracle_linux | — | oracle-linux-upgrade-gnupg2oracle-linux-upgrade-gnupg2-smime | Nov 13, 2020 | Jun 29, 2019 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-gnupg2redhat-upgrade-gnupg2-debuginforedhat-upgrade-gnupg2-debugsourceredhat-upgrade-gnupg2-smimeredhat-upgrade-gnupg2-smime-debuginfo | Nov 5, 2020 | Jun 29, 2019 | |
| Rocky_linux | rocky-upgrade-gnupg2rocky-upgrade-gnupg2-debuginforocky-upgrade-gnupg2-debugsourcerocky-upgrade-gnupg2-smimerocky-upgrade-gnupg2-smime-debuginfo | Mar 12, 2024 | Jun 29, 2019 | |
| Suse | — | suse-upgrade-dirmngrsuse-upgrade-gpg2suse-upgrade-gpg2-lang | Aug 16, 2019 | Jun 29, 2019 |
| Ubuntu | ubuntu-upgrade-gnupg | May 30, 2022 | Jun 29, 2019 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Jun 29, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub