PT-2001-1307 · Gnupg · Gpg

Published 2001-02-12 · Updated 2017-10-10 · CVE-2001-0072

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: gpg (aka GnuPG) versions 1.0.4 and other versions

Description: The issue allows an attacker to potentially break the web of trust by importing both public and private keys from public key servers without notifying the user about the private keys.

Recommendations: For gpg (aka GnuPG) versions 1.0.4 and other versions, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2001-0072

Affected Products

Gpg

References · 9

• http://debian.org/security/2000/20001225b · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-0072 · Security Note
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000368 · Vendor Advisory
• http://securityfocus.com/bid/2153 · Vendor Advisory
• http://linux-mandrake.com/en/updates/2000/MDKSA-2000-087.php3 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2000-131.html · Vendor Advisory
• http://securityfocus.com/archive/1/152197 · Note
• http://osvdb.org/1702 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5803 · Note