Security Update for python-gnupg
Summary
DLA-2862-1: python-gnupg - security update. Affects python-gnupg versions < 0.3.9-1+deb9u1. Fixed in 0.3.9-1+deb9u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-gnupg is a Python wrapper for the GNU Privacy Guard (GnuPG), providing a high-level interface for cryptographic operations. It allows users to encrypt, decrypt, sign, and verify data using GnuPG. This package is widely used in various applications that require secure communication and data protection. However, python-gnupg versions before 0.3.9-1+deb9u1 are vulnerable to two security issues.
Vulnerability Detail
The first vulnerability, identified as CVE-2018-12020, involves the mishandling of certain command line parameters in GnuPG before version 2.2.8. This flaw allows a remote attacker to manipulate the output of GnuPG, making unsigned emails appear signed. The second vulnerability, known as CVE-2019-6690, affects python-gnupg and relates to the incorrect handling of GPG passphrases. An attacker can exploit this flaw by sending a specially crafted passphrase, enabling them to control the output of encryption and decryption operations.
How To Fix
Minimum fixed version
0.3.9-1+deb9u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-gnupgTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, python-gnupg versions prior to 0.3.9-1+deb9u1 are affected by two vulnerabilities that can be exploited by remote attackers. To mitigate these issues, it is crucial to upgrade to the recommended version. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-gnupg →
FAQ
python-gnupg is a Python wrapper for GnuPG, providing a convenient interface for cryptographic operations.
CVE-2018-12020 is a vulnerability that allows an attacker to spoof the output of GnuPG, making unsigned emails appear signed.
CVE-2019-6690 is a vulnerability in python-gnupg that enables an attacker to control the output of encryption and decryption operations by sending a specially crafted passphrase.
To fix the vulnerabilities, you should upgrade python-gnupg to version 0.3.9-1+deb9u1 or later by updating the package using the package manager of the Debian 9 (stretch) distribution.
No specific workaround has been provided for these vulnerabilities. It is recommended to apply the security update as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for python-gnupg.
