Critical Input Validation Flaw in python-gnupg: CVE-2019-6690
Summary
DEBIAN-CVE-2019-6690: python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. Affects python-gnupg versions < 0.4.4-1. Fixed in 0.4.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-gnupg is a Python wrapper for the GnuPG (GNU Privacy Guard) that allows users to manage encryption and decryption of data using GnuPG. It provides a simple interface for key management, signing, and encrypting messages. However, a vulnerability has been identified in version 0.4.3, which allows attackers to exploit improper input validation, potentially leading to unauthorized decryption of sensitive data.
Vulnerability Detail
The vulnerability, identified as CVE-2019-6690, arises from improper input validation in python-gnupg version 0.4.3. Context-dependent attackers can manipulate the passphrase used by GnuPG to decrypt ciphertext, allowing them to trick the system into decrypting unintended data. This flaw is categorized under CWE-20: Improper Input Validation, which can lead to significant security risks, including unauthorized access to sensitive information.
How To Fix
Minimum fixed version
0.4.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-gnupgTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using the vulnerable version (0.4.3) and refrain from processing untrusted ciphertext until the package is updated. Additionally, consider using alternative libraries for encryption that do not exhibit this vulnerability.
Conclusion
The vulnerability CVE-2019-6690 in python-gnupg poses significant risks due to improper input validation, allowing attackers to manipulate decryption processes. Users are strongly encouraged to update to the patched version 0.4.4-1 to mitigate these risks and ensure the security of their applications.
See every vulnerability recorded for python-gnupg →
FAQ
CVE-2019-6690 is a vulnerability in python-gnupg that allows attackers to exploit improper input validation, potentially leading to unauthorized decryption of data.
The affected version is python-gnupg 0.4.3. Versions 0.4.4-1 and later contain the necessary fixes.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without any signup.
If immediate updates are not possible, avoid processing untrusted ciphertext and consider using alternative libraries for encryption.
Vulert is a tool that helps monitor and alert for open-source vulnerabilities in software using just a manifest file. It provides real-time alerts without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-gnupg.
