PT-2019-1354 · Gnupg+2 · Python-Gnupg+2

Alexander Kjäll + 1 · Published 2018-06-09 · Updated 2024-07-12 · CVE-2019-6690

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions python-gnupg version 0.4.3

Description The issue is related to improper input validation, allowing context-dependent attackers to trick gnupg into decrypting other ciphertext than intended. This can be achieved if the passphrase to gnupg is controlled by the adversary and the ciphertext is trusted. The vulnerability exists due to insufficient input validation in the gnupg.GPG.encrypt() and gnupg.GPG.decrypt() methods of the python-gnupg package, which may allow an attacker to execute arbitrary code.

Recommendations For python-gnupg version 0.4.3, consider restricting the use of the gnupg.GPG.encrypt() and gnupg.GPG.decrypt() methods until a patch is available. Additionally, ensure that the passphrase to gnupg is securely managed and that only trusted ciphertext is processed. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2018-1881

ALT-PU-2018-1884

ALT-PU-2018-2427

BDU:2019-00692

CESA-2018_2180

CESA-2018_2181

CVE-2019-6690

DLA-1675-1

DLA-2862-1

GHSA-2FCH-JVG5-CRF6

GHSA-QH62-CH95-63WH

MGASA-2019-0105

OPENSUSE-SU-2019:0143-1

OPENSUSE-SU-2019:0239-1

OPENSUSE-SU-2019_0143-1

OPENSUSE-SU-2024:11261-1

OPENSUSE-SU-2024:14158-1

PYSEC-2019-115

PYSEC-2019-45

RHSA-2018_2180

RHSA-2018_2181

USN-3964-1

USN-4839-1

Affected Products

Suse

Ubuntu

Python-Gnupg

References · 57

• 🔥 https://github.com/brianwrf/CVE-2019-6690 · Exploit
• 🔥 https://github.com/stigtsp/CVE-2019-6690-python-gnupg-vulnerability · Exploit
• 🔥 https://seclists.org/bugtraq/2019/Jan/41 · Exploit
• https://ubuntu.com/security/notices/USN-4839-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-115 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-6690 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00692 · Security Note
• https://osv.dev/vulnerability/MGASA-2019-0105 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4VFRUG56542LTYK4444TPJBGR57MT25 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00058.html · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6KYZMN2PWXY4ENZVJUVTGFBVYEVY7II · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-6690 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2862-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2fch-jvg5-crf6 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qh62-ch95-63wh · Vendor Advisory