mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-gnupgalpine-linux-upgrade-gnupg1 | Jun 15, 2018 | Jun 8, 2018 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-gnupg2amazon-linux-ami-2-upgrade-gnupg2-debuginfoamazon-linux-ami-2-upgrade-gnupg2-smime | Apr 27, 2020 | Jun 8, 2018 | |
| Amazon_linux | — | amazon-linux-upgrade--gnupg2amazon-linux-upgrade-gnupg | Jun 29, 2018 | Jun 8, 2018 |
| Arch Linux | View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗ | arch-linux-upgrade-latest | Jul 11, 2025 | Jun 8, 2018 |
| Centos_linux | — | centos-upgrade-gnupg2centos-upgrade-gnupg2-debuginfocentos-upgrade-gnupg2-smime | Jul 17, 2018 | Jun 8, 2018 |
| Debian | debian-upgrade-enigmaildebian-upgrade-gnupg1debian-upgrade-gnupg2 | Jun 9, 2018 | Jun 8, 2018 | |
| Freebsd | freebsd-upgrade-package-gnupgfreebsd-upgrade-package-gnupg1 | Jun 9, 2018 | Jun 8, 2018 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-gnupg2 | Jul 23, 2018 | Jun 8, 2018 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-gnupg2 | Aug 10, 2018 | Jun 8, 2018 | |
| Oracle Solaris | oracle-solaris-11-3-upgrade-crypto-gnupg-2-0-30-0-175-3-34-0-3-0oracle-solaris-11-3-upgrade-library-security-gpgme-1-6-0-0-175-3-34-0-3-0oracle-solaris-11-3-upgrade-library-security-libassuan-2-4-3-0-175-3-34-0-3-0oracle-solaris-11-3-upgrade-library-security-libksba-1-3-5-0-175-3-34-0-3-0oracle-solaris-11-3-upgrade-security-pinentry-0-7-6-0-175-3-34-0-3-0 | Jul 18, 2018 | Jun 8, 2018 | |
| Oracle_linux | — | oracle-linux-upgrade-gnupg2oracle-linux-upgrade-gnupg2-smime | Jul 12, 2018 | Jun 8, 2018 |
| Redhat_linux | — | redhat-upgrade-gnupg2redhat-upgrade-gnupg2-debuginforedhat-upgrade-gnupg2-smime | Jul 12, 2018 | Jun 8, 2018 |
| Suse | — | suse-upgrade-dirmngrsuse-upgrade-enigmailsuse-upgrade-gpg2suse-upgrade-gpg2-langsuse-upgrade-python2-python-gnupgsuse-upgrade-python3-python-gnupg | Jun 16, 2018 | Jun 8, 2018 |
| Ubuntu | ubuntu-pro-upgrade-python-gnupgubuntu-pro-upgrade-python3-gnupgubuntu-upgrade-gnupgubuntu-upgrade-gnupg2ubuntu-upgrade-gpgubuntu-upgrade-python-gnupgubuntu-upgrade-python3-gnupg | Jun 13, 2018 | Jun 8, 2018 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Jun 8, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub