Critical Array Overflow Vulnerability in GnuPG Package
Summary
ALPINE-CVE-2020-25125: GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker's OpenPGP key, and this key has AEAD preferences. Affects gnupg versions < 2.2.23-r0. Fixed in 2.2.23-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GnuPG (GNU Privacy Guard) is a widely used open-source software for secure communication and data storage. It allows users to encrypt and sign their data and communications, ensuring confidentiality and authenticity. The software implements the OpenPGP standard and is essential for users who require strong encryption solutions. However, a critical vulnerability has been identified in versions 2.2.21 and 2.2.22, which could lead to severe security implications if exploited.
Vulnerability Detail
The vulnerability, identified as CVE-2020-25125, is an array overflow issue that occurs when a victim imports an attacker's OpenPGP key containing AEAD preferences. This flaw is rooted in an error within the g10/key-check.c file of GnuPG. The consequences of this vulnerability include potential crashes of the application and possibly other unspecified impacts, making it a significant risk for users. GnuPG version 2.3.x is unaffected, and the issue has been resolved in version 2.2.23.
How To Fix
Minimum fixed version
2.2.23-r0
This is the first release that contains the fix.
sudo apk add --upgrade gnupgTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid importing OpenPGP keys from untrusted sources until they can update to the patched version. This precaution can help mitigate the risk of exploitation while waiting for the update.
Conclusion
The identified vulnerability in GnuPG poses significant risks to users, particularly those who handle sensitive data. It is crucial to update to version 2.2.23 or later to ensure protection against potential exploitation. Users are encouraged to remain vigilant and utilize tools like Vulert for ongoing monitoring of vulnerabilities in their software.
See every vulnerability recorded for gnupg →
FAQ
CVE-2020-25125 is a critical vulnerability in GnuPG that allows for an array overflow when importing certain OpenPGP keys, potentially leading to application crashes.
The affected versions are GnuPG 2.2.21 and 2.2.22. Version 2.3.x is not affected by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The CVSS score of CVE-2020-25125 is 7.8, indicating a high severity level.
If you cannot update immediately, avoid importing OpenPGP keys from untrusted sources as a temporary workaround to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for gnupg.
