GNU » Privacy Guard » 1.2.2 : Security Vulnerabilities, CVEs,
gpgv in GnuPG before 1.4.2.1, when using unattended signature verification, returns a 0 exit code in certain cases even when the detached signature file does not carry a signature, which could cause programs that use gpgv to assume that the signature verification has succeeded. Note: this also occurs when running the equivalent command "gpg --verify".
Max CVSS
4.6
EPSS Score
0.12%
Published
2006-02-15
Updated
2023-02-13
gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, which allows attackers to inject unsigned data via a data packet that is not associated with a control packet, which causes the check for concatenated signatures to report that the signature is valid, a different vulnerability than CVE-2006-0455.
Max CVSS
5.0
EPSS Score
0.60%
Published
2006-03-13
Updated
2018-10-19
Format string vulnerability in gpgkeys_hkp (experimental HKP interface) for the GnuPG (gpg) client 1.2.3 and earlier, and 1.3.3 and earlier, allows remote attackers or a malicious keyserver to cause a denial of service (crash) and possibly execute arbitrary code during key retrieval.
Max CVSS
7.5
EPSS Score
3.47%
Published
2004-01-05
Updated
2017-07-11
GnuPG (GPG) 1.0.2, and other versions up to 1.2.3, creates ElGamal type 20 (sign+encrypt) keys using the same key component for encryption as for signing, which allows attackers to determine the private key from a signature.
Max CVSS
5.0
EPSS Score
1.66%
Published
2003-12-15
Updated
2017-10-11
4 vulnerabilities found