mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade gnupg1Upgrade gnupg | Jun 15, 2018 | Jun 8, 2018 |
| Amazon Linux Ami 2 | — | Upgrade gnupg2Upgrade gnupg2-smimeUpgrade gnupg2-debuginfo | Apr 27, 2020 | Jun 8, 2018 |
| Amazon_linux | — | Upgrade gnupgUpgrade gnupg2 | Jun 29, 2018 | Jun 8, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 8, 2018 |
| Centos_linux | — | Upgrade gnupg2-debuginfoUpgrade gnupg2Upgrade gnupg2-smime | Jul 17, 2018 | Jun 8, 2018 |
| Debian | — | Upgrade gnupg1Upgrade gnupg2Upgrade enigmail | Jun 9, 2018 | Jun 8, 2018 |
| Freebsd | — | Upgrade gnupg1Upgrade gnupg | Jun 9, 2018 | Jun 8, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade gnupg2 | Jul 23, 2018 | Jun 8, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade gnupg2 | Aug 10, 2018 | Jun 8, 2018 |
| Oracle Solaris | — | Upgrade crypto/gnupg to version 2.0.30-0.175.3.34.0.3.0 on Solaris 11.3Upgrade library/security/gpgme to version 1.6.0-0.175.3.34.0.3.0 on Solaris 11.3Upgrade security/pinentry to version 0.7.6-0.175.3.34.0.3.0 on Solaris 11.3Upgrade library/security/libksba to version 1.3.5-0.175.3.34.0.3.0 on Solaris 11.3Upgrade library/security/libassuan to version 2.4.3-0.175.3.34.0.3.0 on Solaris 11.3 | Jul 18, 2018 | Jun 8, 2018 |
| Oracle_linux | — | Upgrade gnupg2-smimeUpgrade gnupg2 | Jul 12, 2018 | Jun 8, 2018 |
| Redhat_linux | — | Upgrade gnupg2-debuginfoUpgrade gnupg2-smimeUpgrade gnupg2No solution exists | Jul 12, 2018 | Jun 8, 2018 |
| Suse | — | Upgrade python2-python-gnupgUpgrade dirmngrUpgrade enigmailUpgrade gpg2-langUpgrade python3-python-gnupgUpgrade gpg2 | Jun 16, 2018 | Jun 8, 2018 |
| Ubuntu | — | Upgrade gnupgUpgrade python3-gnupg (Ubuntu Pro)Upgrade python-gnupg (Ubuntu Pro)Upgrade gpgUpgrade python-gnupgUpgrade gnupg2Upgrade python3-gnupg | Jun 13, 2018 | Jun 8, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 8, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub