PT-2020-15965 · Intevation Gmbh+1 · Gpg4Win+1

Andreas Stieger · Published 2020-09-03 · Updated 2024-06-15 · CVE-2020-25125

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GnuPG versions 2.2.21 through 2.2.22 Gpg4win version 3.1.12

Description The issue is caused by an array overflow in the g10/key-check.c file, leading to a crash or possibly unspecified other impact when a victim imports an attacker's OpenPGP key with AEAD preferences.

Recommendations For GnuPG versions 2.2.21 and 2.2.22, update to version 2.2.23 to resolve the issue. For Gpg4win version 3.1.12, update to a version that includes the fix for GnuPG, such as GnuPG 2.2.23. As a temporary workaround, consider avoiding the import of OpenPGP keys with AEAD preferences until the issue is resolved.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2020-25125

OPENSUSE-SU-2024:10815-1

Affected Products

Gnupg

Gpg4Win

References · 21

• 🔥 https://bugzilla.opensuse.org/show_bug.cgi?id=1176034 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:10815-1 · Vendor Advisory
• https://lists.gnupg.org/pipermail/gnupg-announce/2020q3/000448.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25125 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25125 · Vendor Advisory
• https://dev.gnupg.org/rG8ec9573e57866dda5efb4677d4454161517484bc · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2020-25125 · Vendor Advisory
• https://t.me/tmfeed/92380 · Telegram Post
• https://t.me/opennews/7363 · Telegram Post
• https://suse.com/security/cve/CVE-2018-12020 · Note
• https://suse.com/security/cve/CVE-2008-1530 · Note
• https://suse.com/security/cve/CVE-2020-25125 · Note
• https://suse.com/security/cve/CVE-2006-0455 · Note
• https://suse.com/security/cve/CVE-2006-3746 · Note
• https://suse.com/security/cve/CVE-2019-14855 · Note