| Vulnerability Name: | CVE-2020-25125 (CCN-187750) | ||||||||||||||||||||||||||||||||||||||||||||
| Assigned: | 2020-09-03 | ||||||||||||||||||||||||||||||||||||||||||||
| Published: | 2020-09-03 | ||||||||||||||||||||||||||||||||||||||||||||
| Updated: | 2020-09-11 | ||||||||||||||||||||||||||||||||||||||||||||
| Summary: | GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker's OpenPGP key, and this key has AEAD preferences. The overflow is caused by a g10/key-check.c error. Note: GnuPG 2.3.x is unaffected. GnuPG 2.2.23 is a fixed version. | ||||||||||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) 6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
4.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
| ||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-120 | ||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Denial of Service | ||||||||||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2020-25125 Source: MLIST Type: Mailing List, Third Party Advisory [oss-security] 20200903 GNUPG released with AEAD sec fix CVE-2020-25125 Source: MLIST Type: Mailing List, Third Party Advisory [oss-security] 20200903 CVE-2020-25125: gnupg2: buffer overflow when importing a key with AEAD preferences Source: MISC Type: Exploit, Issue Tracking, Third Party Advisory https://bugzilla.opensuse.org/show_bug.cgi?id=1176034 Source: MISC Type: Patch, Vendor Advisory https://dev.gnupg.org/rG8ec9573e57866dda5efb4677d4454161517484bc Source: MISC Type: Mailing List https://dev.gnupg.org/T5050 Source: XF Type: UNKNOWN gnupg-cve202025125-dos(187750) Source: CCN Type: GnuPG Web site GnuPG and Gpg4win Source: MISC Type: Vendor Advisory https://lists.gnupg.org/pipermail/gnupg-announce/2020q3/000448.html Source: CCN Type: oss-sec Mailing List, Thu, 3 Sep 2020 20:09:36 +0200 GNUPG released with AEAD sec fix CVE-2020-25125 | ||||||||||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||||||||||