Bug 740240 (CVE-2020-25125)

Summary:	<app-crypt/gnupg-2.2.23: Buffer overflow in AEAD preference parser (CVE-2020-25125)
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	alexander, glsamaker, k_f, polynomial-c, zlogene
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://lists.gnupg.org/pipermail/gnupg-announce/2020q3/000448.html
Whiteboard:	~2 [noglsa cve]
Package list:		Runtime testing required:	---

Description Sam James archtester

2020-09-03 19:26:25 UTC

Description:
“GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker's OpenPGP key, and this key has AEAD preferences. The overflow is caused by a g10/key-check.c error. NOTE: GnuPG 2.3.x is unaffected. GnuPG 2.2.23 is a fixed version.”

Comment 1 Sam James archtester

2020-09-03 19:28:25 UTC

Needs cleanup.

“ If GnuPG version 2.2.21 or 2.2.22 is in use please update ASAP to
version 2.2.23.

If you are using an older version or a beta of version 2.3 no immediate
action is required.”

Bug: https://dev.gnupg.org/T5050

Comment 2 Thomas Deutschmann (RETIRED) gentoo-dev

2020-09-05 19:51:19 UTC

*** Bug 740572 has been marked as a duplicate of this bug. ***