Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 740240 (CVE-2020-25125) - <app-crypt/gnupg-2.2.23: Buffer overflow in AEAD preference parser (CVE-2020-25125)
Summary: <app-crypt/gnupg-2.2.23: Buffer overflow in AEAD preference parser (CVE-2020-...
Status: RESOLVED FIXED
Alias: CVE-2020-25125
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://lists.gnupg.org/pipermail/gnu...
Whiteboard: ~2 [noglsa cve]
Keywords:
: 740572 (view as bug list)
Depends on:
Blocks:
 
Reported: 2020-09-03 19:26 UTC by Sam James
Modified: 2020-09-05 19:51 UTC (History)
5 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-09-03 19:26:25 UTC
Description:
“GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker's OpenPGP key, and this key has AEAD preferences. The overflow is caused by a g10/key-check.c error. NOTE: GnuPG 2.3.x is unaffected. GnuPG 2.2.23 is a fixed version.”
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-09-03 19:28:25 UTC
Needs cleanup.

“ If GnuPG version 2.2.21 or 2.2.22 is in use please update ASAP to
version 2.2.23.

If you are using an older version or a beta of version 2.3 no immediate
action is required.”

Bug: https://dev.gnupg.org/T5050
Comment 2 Thomas Deutschmann gentoo-dev 2020-09-05 19:51:19 UTC
*** Bug 740572 has been marked as a duplicate of this bug. ***