Critical Vulnerabilities in python-gnupg: Spoofing and Passphrase Exploitation
Summary
USN-4839-1: python-gnupg vulnerabilities. Affects python-gnupg versions < 0.3.6-1ubuntu0.1~esm1. Fixed in 0.3.6-1ubuntu0.1~esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-gnupg is a Python library that provides an interface to the GNU Privacy Guard (GPG), allowing users to encrypt and sign data and communications. It is widely used for secure email communication and data protection. However, vulnerabilities in this package can lead to serious security risks, including the potential for attackers to spoof signed messages and manipulate encryption outputs.
Vulnerability Detail
Two significant vulnerabilities have been identified in python-gnupg. The first, CVE-2018-12020, allows a remote attacker to spoof the output of python-gnupg by improperly handling command line parameters, making unsigned emails appear as if they are signed. The second vulnerability, CVE-2019-6690, arises from incorrect handling of GPG passphrases, enabling attackers to control the output of encryption and decryption operations by sending specially crafted passphrases. Both vulnerabilities pose serious risks to data integrity and confidentiality.
How To Fix
Minimum fixed version
0.3.6-1ubuntu0.1~esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-gnupgTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using python-gnupg for critical operations involving sensitive data until the package is updated. Additionally, consider using alternative libraries for encryption and signing until the vulnerabilities are addressed.
Conclusion
The vulnerabilities in python-gnupg present serious risks to users, particularly in terms of data integrity and confidentiality. It is crucial to update to the patched versions as soon as possible to mitigate these risks. Users are also encouraged to explore alternative solutions and monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for python-gnupg →
FAQ
The main vulnerabilities are CVE-2018-12020, which allows spoofing of signed messages, and CVE-2019-6690, which enables control over encryption outputs through crafted passphrases.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
If an immediate update is not possible, avoid using python-gnupg for sensitive operations and consider alternative libraries until the vulnerabilities are patched.
While specific exploits may not be publicly documented, the vulnerabilities allow for significant manipulation of data integrity and confidentiality, making them critical to address.
More information can be found in the Ubuntu Security Notices, specifically USN-4839-1, which details the vulnerabilities and their impact.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-gnupg.
