Critical Vulnerabilities in python-gnupg: Spoofing and Passphrase Manipulation Risks
Summary
USN-3964-1: python-gnupg vulnerabilities. Affects python-gnupg versions < 0.4.1-1ubuntu1.18.04.1. Fixed in 0.4.1-1ubuntu1.18.04.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
python-gnupg is a Python wrapper for GnuPG, allowing users to manage GnuPG keys and perform encryption and decryption operations in Python applications. It is widely used for secure communication and data protection. However, vulnerabilities in this package can lead to severe security risks, including the potential for remote attackers to manipulate cryptographic operations.
Vulnerability Detail
The vulnerabilities stem from improper handling of command line parameters and GPG passphrases in python-gnupg. Specifically, CVE-2018-12020 allows remote attackers to spoof GnuPG output, making unsigned emails appear signed. CVE-2019-6690 enables attackers to control encryption and decryption outputs by sending specially crafted passphrases. These vulnerabilities can lead to significant security breaches, compromising the integrity of encrypted communications.
How To Fix
Minimum fixed version
0.4.1-1ubuntu1.18.04.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-gnupgTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using the affected functionalities of python-gnupg until the package is updated. Additionally, consider using alternative libraries for cryptographic operations that do not exhibit these vulnerabilities.
Conclusion
The vulnerabilities in python-gnupg pose significant risks to users relying on this package for secure communications. It is crucial to update to the latest patched version to mitigate these risks and ensure the integrity of cryptographic operations.
See every vulnerability recorded for python-gnupg →
FAQ
python-gnupg is a Python library that provides a wrapper around the GnuPG encryption software, enabling developers to perform cryptographic operations in their Python applications.
The main vulnerabilities include improper handling of command line parameters and GPG passphrases, which can lead to spoofing of signed messages and manipulation of encryption outputs.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you cannot update the package, refrain from using the affected functionalities and consider using alternative libraries for cryptographic operations.
More information can be found in the Ubuntu Security Notices, specifically USN-3964-1, which details the vulnerabilities and their implications.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-gnupg.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
