python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting the affect functionality component.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4839-1 advisory.

    Marcus Brinkmann discovered that python-gnupg improperly handled certain command line parameters. A remote     attacker could use this to spoof the output of python-gnupg and cause unsigned e-mail to appear signed.
    (CVE-2018-12020)

    It was discovered that python-gnupg incorrectly handled the GPG passphrase. A remote attacker could send a     specially crafted passphrase that would allow them to control the output of encryption and decryption     operations. (CVE-2019-6690)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2862 advisory.

  - mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification     actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other     programs that use the --status-fd 2 option. For example, the OpenPGP data might represent an original     filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.
    (CVE-2018-12020)

  - python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than     intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the     ciphertext should be trusted. Related to a CWE-20: Improper Input Validation issue affecting the affect     functionality component. (CVE-2019-6690)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

New python-gnupg version

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3964-1 advisory.

    Marcus Brinkmann discovered that GnuPG before 2.2.8 improperly handled certain command line parameters. A     remote attacker could use this to spoof the output of GnuPG and cause unsigned e-mail to appear signed.
    (CVE-2018-12020)

    It was discovered that python-gnupg incorrectly handled the GPG passphrase. A remote attacker could send a     specially crafted passphrase that would allow them to control the output of encryption and decryption     operations. (CVE-2019-6690)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Alexander Kj&auml;ll and Stig Palmquist discovered a vulnerability in python-gnupg, a wrapper around GNU Privacy Guard. It was possible to inject data through the passphrase property of the gnupg.GPG.encrypt() and gnupg.GPG.decrypt() functions when symmetric encryption is used.
The supplied passphrase is not validated for newlines, and the library passes --passphrase-fd=0 to the gpg executable, which expects the passphrase on the first line of stdin, and the ciphertext to be decrypted or plaintext to be encrypted on subsequent lines.

By supplying a passphrase containing a newline an attacker can control/modify the ciphertext/plaintext being decrypted/encrypted.

For Debian 8 'Jessie', this problem has been fixed in version 0.3.6-1+deb8u1.

We recommend that you upgrade your python-gnupg packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python-python-gnupg to version 0.4.4 fixes the following issues :

Security issue fixed :

  - CVE-2019-6690: Added a check to disallow certain control     characters ('\r', '\n', NUL) in passphrases     (boo#1123498).

ID	Name	Product	Family	Severity
183563	Ubuntu 16.04 ESM : python-gnupg vulnerabilities (USN-4839-1)	Nessus	Ubuntu Local Security Checks	high
156336	Debian DLA-2862-1 : python-gnupg - LTS security update	Nessus	Debian Local Security Checks	high
138411	Fedora 31 : python-gnupg (2020-e67d007a67)	Nessus	Fedora Local Security Checks	high
138398	Fedora 32 : python-gnupg (2020-17fb3273b2)	Nessus	Fedora Local Security Checks	high
124587	Ubuntu 18.04 LTS : python-gnupg vulnerabilities (USN-3964-1)	Nessus	Ubuntu Local Security Checks	high
122195	Debian DLA-1675-1 : python-gnupg security update	Nessus	Debian Local Security Checks	high
121634	openSUSE Security Update : python-python-gnupg (openSUSE-2019-143)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2019-6690

high

Tenable Plugins

high

high

high

high

high

high

high