CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCVE-2019-6690
python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting the affect functionality component.
Severity
- EPSS
- 8.6% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:ubuntu_linux
- debian:debian_linux
- opensuse:leap
- python:python-gnupg
- suse:backports
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-2fch-jvg5-crf6 | PyPI | python-gnupg | <0.4.4 | 0.4.4 |
| PYSEC-2019-115 | PyPI | python-gnupg | <0.4.4 | 0.4.4 |
References
- http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00058.html
- http://packetstormsecurity.com/files/151341/Python-GnuPG-0.4.3-Improper-Input-Validation.html
- http://www.securityfocus.com/bid/106756
- https://blog.hackeriet.no/cve-2019-6690-python-gnupg-vulnerability/