GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Disclosure, DoS. This attack appear to be exploitable via Victim must perform a WKD request, e.g. enter an email address in the composer window of Thunderbird/Enigmail. This vulnerability appears to have been fixed in after commit 4a4bb874f63741026bd26264c43bb32b1099f060.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade gnupg2-smimeUpgrade gnupg2 | May 4, 2022 | Dec 20, 2018 |
| Centos_linux | — | Upgrade gnupg2-smimeUpgrade gnupg2-smime-debuginfoUpgrade gnupg2-debuginfoUpgrade gnupg2-debugsourceUpgrade gnupg2 | Jun 1, 2021 | Dec 20, 2018 |
| Debian | — | Upgrade gnupg2 | Jul 30, 2024 | Dec 20, 2018 |
| Oracle Solaris | — | Upgrade crypto/gnupg to version 2.2.16-11.4.15.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Dec 20, 2018 |
| Redhat_linux | — | Upgrade gnupg2-debuginfoUpgrade gnupg2-debugsourceUpgrade gnupg2-smime-debuginfoUpgrade gnupg2Upgrade gnupg2-smime | May 19, 2021 | Dec 20, 2018 |
| Rocky_linux | — | Upgrade gnupg2-smimeUpgrade gnupg2-smime-debuginfoUpgrade gnupg2Upgrade gnupg2-debuginfoUpgrade gnupg2-debugsource | Mar 12, 2024 | Dec 20, 2018 |
| Suse | — | Upgrade dirmngrUpgrade gpg2Upgrade gpg2-lang | Jan 13, 2019 | Dec 20, 2018 |
| Ubuntu | — | Upgrade gnupgUpgrade gpg-wks-client | Jan 17, 2019 | Dec 20, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 20, 2018 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub