Vulnerability in python-gnupg allows decryption of unintended ciphertext
Summary
CVE-2019-6690: Withdrawn: Duplicate of GHSA-2fch-jvg5-crf6. Affects python-gnupg versions < 0.4.4. Fixed in 0.4.4. How to fix ↓
Also tracked for
- python-gnupg · Debian:11
The same CVE-2019-6690 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-gnupg is a Python module that provides a high-level interface to the GNU Privacy Guard (GPG) cryptographic library. It allows users to encrypt, decrypt, sign, and verify messages using GPG. The module is widely used in Python applications that require secure communication and data encryption. However, a vulnerability has been discovered in python-gnupg that could be exploited by context-dependent attackers to trick gnupg into decrypting ciphertext other than the intended one.
Vulnerability Detail
The vulnerability in python-gnupg arises from a context-dependent attack. Attackers can manipulate the context in which gnupg is used to decrypt ciphertext that was not intended for decryption. This could lead to the exposure of sensitive information or the decryption of maliciously crafted ciphertext. The vulnerability has a moderate severity rating and was first reported on March 13, 2020. It was later withdrawn as a duplicate on June 16, 2020. The affected versions of python-gnupg range from 0 to 0.4.4.
How To Fix
Minimum fixed version
0.4.4
This is the first release that contains the fix.
pip install --upgrade "python-gnupg==0.4.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in python-gnupg allows context-dependent attackers to decrypt unintended ciphertext. It is recommended to update python-gnupg to version 0.4.4 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-gnupg →
FAQ
python-gnupg is a Python module that provides a high-level interface to the GNU Privacy Guard (GPG) cryptographic library. It allows users to encrypt, decrypt, sign, and verify messages using GPG.
The vulnerability allows context-dependent attackers to decrypt ciphertext other than the intended one. This could lead to the exposure of sensitive information or the decryption of maliciously crafted ciphertext.
The vulnerability has a moderate severity rating.
This vulnerability was first reported on March 13, 2020.
Yes, this vulnerability has been fixed in python-gnupg version 0.4.4.
Related vulnerabilities
Recent vulnerabilities recorded for python-gnupg.
