Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade gnupg2Upgrade gnupg2-smime | May 4, 2022 | Jun 29, 2019 |
| Centos_linux | — | Upgrade gnupg2Upgrade gnupg2-debuginfoUpgrade gnupg2-smime-debuginfoUpgrade gnupg2-smimeUpgrade gnupg2-debugsource | Nov 5, 2020 | Jun 29, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade gnupg2-smimeUpgrade gnupg2 | Feb 26, 2020 | Jun 29, 2019 |
| Oracle Solaris | — | Upgrade crypto/gnupg to version 2.2.17-11.4.16.0.1.3.0 on Solaris 11.4 | Dec 18, 2019 | Jun 29, 2019 |
| Oracle_linux | — | Upgrade gnupg2Upgrade gnupg2-smime | Nov 13, 2020 | Jun 29, 2019 |
| Redhat_linux | — | Upgrade gnupg2-debuginfoUpgrade gnupg2-debugsourceUpgrade gnupg2-smime-debuginfoNo solution existsUpgrade gnupg2-smimeUpgrade gnupg2 | Nov 5, 2020 | Jun 29, 2019 |
| Rocky_linux | — | Upgrade gnupg2-smimeUpgrade gnupg2-smime-debuginfoUpgrade gnupg2-debugsourceUpgrade gnupg2-debuginfoUpgrade gnupg2 | Mar 12, 2024 | Jun 29, 2019 |
| Suse | — | Upgrade gpg2Upgrade dirmngrUpgrade gpg2-lang | Aug 16, 2019 | Jun 29, 2019 |
| Ubuntu | — | Upgrade gnupg | May 30, 2022 | Jun 29, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 29, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub