Bug 861446 (CVE-2022-3219)

Summary:	app-crypt/gnupg: denial of service issue (resource consumption) using compressed packets
Product:	Gentoo Security	Reporter:	Hank Leininger <hlein>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	UNCONFIRMED ---
Severity:	normal	CC:	base-system, zlogene
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://marc.info/?l=oss-security&m=165696590211434&w=4
Whiteboard:	A3 [upstream]
Package list:		Runtime testing required:	---

Description Hank Leininger 2022-07-27 11:37:18 UTC

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB; see $URL and the surrounding email threads for more details and test-cases.

The reporter has some proposed patches at https://dev.gnupg.org/D556 (and in oss-security / gnupg-devel threads); mostly these flag/reject compressed packets and indeterminate-length packets in contexts where they make no sense and arguably are not within the spec (certificates, keys, detached signatures).

No CVE has been assigned yet AFAIK.

Comment 1 John Helmert III archtester

2023-02-26 17:13:12 UTC

According to werner on the issue (https://dev.gnupg.org/T5993), "This specificiation is a draft which has not even been discussed in the WG. In any case gpg won't implement this because it would break processing of existing data."