CVE-2019-6690: Improper Input Validation in python-gnupg
Summary
CVE-2019-6690: Improper Input Validation python-gnupg. Affects python-gnupg versions < 0.4.4. Fixed in 0.4.4. How to fix ↓
Also tracked for
- python-gnupg · Debian:11
The same CVE-2019-6690 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-gnupg is a Python module that provides a high-level interface to the GNU Privacy Guard (GPG) cryptographic library. It allows users to encrypt, decrypt, sign, and verify data using GPG. The vulnerability identified as CVE-2019-6690 is related to improper input validation in python-gnupg version 0.4.3. This vulnerability can be exploited by context-dependent attackers who can manipulate the passphrase provided to gnupg and trick it into decrypting unintended ciphertext. The issue falls under the category of 'Improper Input Validation' (CWE-20), which affects the functionality component of python-gnupg.
Vulnerability Detail
The vulnerability in python-gnupg 0.4.3 allows attackers to deceive gnupg into decrypting ciphertext other than the intended one. To exploit this vulnerability, the attacker must have control over the passphrase used by gnupg, and the ciphertext must be trusted. This can lead to unauthorized access to sensitive information or the decryption of maliciously crafted ciphertext. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Minimum fixed version
0.4.4
This is the first release that contains the fix.
pip install --upgrade "python-gnupg==0.4.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the vulnerability in python-gnupg 0.4.3 allows attackers to manipulate gnupg into decrypting unintended ciphertext. Users are advised to upgrade to python-gnupg version 0.4.4 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-gnupg →
FAQ
python-gnupg is a Python module that provides a high-level interface to the GNU Privacy Guard (GPG) cryptographic library. It allows users to perform various cryptographic operations such as encryption, decryption, signing, and verification using GPG.
The vulnerability allows attackers to manipulate gnupg into decrypting ciphertext other than the intended one. This can lead to unauthorized access to sensitive information or the decryption of maliciously crafted ciphertext.
To fix this vulnerability, users should upgrade to python-gnupg version 0.4.4 or later. The updated version includes a fix for the improper input validation issue.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of python-gnupg.
The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
Related vulnerabilities
Recent vulnerabilities recorded for python-gnupg.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.