Critical Vulnerability in python-gnupg: Context-dependent Attack Risk
Summary
UBUNTU-CVE-2019-6690: python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. Affects python-gnupg versions < 0.3.6-1ubuntu0.1~esm1. Fixed in 0.3.6-1ubuntu0.1~esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-gnupg is a Python library that provides a simple interface to GnuPG, allowing developers to integrate encryption and decryption functionalities into their applications. It is widely used for secure data handling and cryptographic operations. However, a vulnerability has been identified in versions prior to 0.4.1, which can be exploited by attackers to manipulate the decryption process.
Vulnerability Detail
The vulnerability, identified as CVE-2019-6690, allows context-dependent attackers to trick the python-gnupg library into decrypting unintended ciphertext. This occurs when the passphrase used for decryption is controlled by the attacker, and the ciphertext is trusted. The issue is related to improper input validation, which can lead to unauthorized access to sensitive information. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
0.3.6-1ubuntu0.1~esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-gnupgTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid using untrusted passphrases and ensure that the ciphertext being decrypted is from a reliable source. Additionally, implementing strict input validation can help mitigate the risk until the package is updated.
Conclusion
The python-gnupg library has a critical vulnerability (CVE-2019-6690) that can be exploited by attackers to decrypt unintended ciphertext. It is crucial for users to update to the latest patched version to protect sensitive data. Implementing strict input validation and using trusted sources for passphrases can help mitigate risks until the update is applied.
See every vulnerability recorded for python-gnupg →
FAQ
CVE-2019-6690 is a vulnerability in the python-gnupg library that allows attackers to manipulate the decryption process by controlling the passphrase.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability can lead to unauthorized access to sensitive data, as attackers can decrypt ciphertext that should remain secure.
Yes, a patched version of python-gnupg is available. Users should update to version 0.4.1-1ubuntu1.18.04.1 or later.
If immediate updates are not possible, ensure that you use trusted passphrases and validate the sources of your ciphertext to minimize risk.
Related vulnerabilities
Recent vulnerabilities recorded for python-gnupg.
