CVE-2019-6690: python-gnupg - Improper Input Validation
Summary
CVE-2019-6690: python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. Affects python-gnupg versions < 0.4.4. Fixed in 0.4.4. How to fix ↓
Also tracked for
- python-gnupg · Debian:11
The same CVE-2019-6690 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-gnupg is a Python module that provides a high-level interface to the GNU Privacy Guard (GPG) cryptographic library. It allows users to encrypt, decrypt, sign, and verify data using GPG. The module is commonly used in Python applications that require secure communication and data protection. However, python-gnupg version 0.4.3 is vulnerable to an improper input validation issue, which can be exploited by context-dependent attackers to trick gnupg into decrypting unintended ciphertext. This vulnerability is related to CWE-20, which is the improper input validation weakness.
Vulnerability Detail
The vulnerability in python-gnupg version 0.4.3 arises when the passphrase to gnupg is controlled by an adversary and the ciphertext is trusted. In such a scenario, an attacker can manipulate the input to decrypt ciphertext that was not intended for decryption. This can lead to unauthorized access to sensitive information and potential data breaches. The vulnerability affects the functionality component of python-gnupg.
How To Fix
Minimum fixed version
0.4.4
This is the first release that contains the fix.
pip install --upgrade "python-gnupg==0.4.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest version of python-gnupg as soon as possible.
Conclusion
In conclusion, python-gnupg version 0.4.3 is vulnerable to an improper input validation issue that can be exploited by attackers to decrypt unintended ciphertext. Users should update to version 0.4.4 or later to fix this vulnerability. If you need further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-gnupg →
FAQ
python-gnupg is a Python module that provides a high-level interface to the GNU Privacy Guard (GPG) cryptographic library. It allows users to encrypt, decrypt, sign, and verify data using GPG.
This vulnerability allows context-dependent attackers to decrypt unintended ciphertext, potentially leading to unauthorized access to sensitive information and data breaches.
To fix this vulnerability, you should upgrade to python-gnupg version 0.4.4 or later. Run the command 'pip install --upgrade python-gnupg' to update the package.
There is no known workaround for this vulnerability. It is recommended to update to the latest version of python-gnupg.
You can find more information about this vulnerability in the official python-gnupg advisory: [link to advisory]
Related vulnerabilities
Recent vulnerabilities recorded for python-gnupg.
