CVE-2019-6690: python-gnupg Vulnerability Allows Decryption of Unintended Ciphertext
Summary
CVE-2019-6690: python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. Affects python-gnupg versions < 0.4.4-1. Fixed in 0.4.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-gnupg is a Python wrapper for GnuPG, allowing users to encrypt and decrypt data using GnuPG's capabilities. It is widely used for secure data handling in applications that require encryption. The package provides an interface for managing keys, encrypting messages, and signing documents. However, it is susceptible to a vulnerability that can be exploited if an attacker controls the passphrase used for decryption, potentially leading to unauthorized access to sensitive information.
Vulnerability Detail
CVE-2019-6690 is a vulnerability in python-gnupg version 0.4.3 that allows context-dependent attackers to trick the library into decrypting ciphertext that was not intended for them. This issue arises from improper input validation (CWE-20), where the passphrase for GnuPG is controlled by the adversary, and the ciphertext is trusted. If exploited, this vulnerability can lead to the exposure of sensitive data, as attackers can manipulate the decryption process to access unintended information.
How To Fix
Minimum fixed version
0.4.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-gnupgTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the passphrase used for GnuPG is not controlled by untrusted parties. Additionally, avoid using trusted ciphertext from untrusted sources until the package is updated.
Conclusion
CVE-2019-6690 is a significant vulnerability in the python-gnupg package that can lead to unauthorized decryption of sensitive data. Users are strongly advised to upgrade to the latest version to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python-gnupg →
FAQ
CVE-2019-6690 is a vulnerability in python-gnupg that allows attackers to decrypt unintended ciphertext if they control the passphrase.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to unauthorized access to sensitive information, as attackers can manipulate the decryption process.
The CVSS score for CVE-2019-6690 is 7.5, indicating a high severity level.
If an immediate upgrade is not possible, ensure that the passphrase is secure and avoid using trusted ciphertext from untrusted sources.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-gnupg.
