CVE-2003-0971

2003-12-1505:00:00

mitre

web.nvd.nist.gov

cve

gnupg

gpg

elgamal

encryption

signature

private key

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

6.1

Confidence

Low

EPSS

0.012

Percentile

85.5%

JSON

GnuPG (GPG) 1.0.2, and other versions up to 1.2.3, creates ElGamal type 20 (sign+encrypt) keys using the same key component for encryption as for signing, which allows attackers to determine the private key from a signature.

Affected configurations

Nvd

Node

gnuprivacy_guardMatch1.0.2

gnuprivacy_guardMatch1.0.3

gnuprivacy_guardMatch1.0.3b

gnuprivacy_guardMatch1.0.4

gnuprivacy_guardMatch1.0.5

gnuprivacy_guardMatch1.0.6

gnuprivacy_guardMatch1.0.7

gnuprivacy_guardMatch1.2

gnuprivacy_guardMatch1.2.1

gnuprivacy_guardMatch1.2.2

gnuprivacy_guardMatch1.2.2rc1

gnuprivacy_guardMatch1.2.3

VendorProductVersionCPE
gnuprivacy_guard1.2.2cpe:/a:gnu:privacy_guard:1.2.2:rc1::
gnuprivacy_guard1.0.3bcpe:/a:gnu:privacy_guard:1.0.3b:::
gnuprivacy_guard1.0.5cpe:/a:gnu:privacy_guard:1.0.5:::
gnuprivacy_guard1.2.3cpe:/a:gnu:privacy_guard:1.2.3:::
gnuprivacy_guard1.0.2cpe:/a:gnu:privacy_guard:1.0.2:::
gnuprivacy_guard1.2.2cpe:/a:gnu:privacy_guard:1.2.2:::
gnuprivacy_guard1.0.7cpe:/a:gnu:privacy_guard:1.0.7:::
gnuprivacy_guard1.2cpe:/a:gnu:privacy_guard:1.2:::
gnuprivacy_guard1.0.4cpe:/a:gnu:privacy_guard:1.0.4:::
gnuprivacy_guard1.2.1cpe:/a:gnu:privacy_guard:1.2.1:::

Vendor	Product	Version	CPE
gnu	privacy_guard	1.2.2	cpe:/a:gnu:privacy_guard:1.2.2:rc1::
gnu	privacy_guard	1.0.3b	cpe:/a:gnu:privacy_guard:1.0.3b:::
gnu	privacy_guard	1.0.5	cpe:/a:gnu:privacy_guard:1.0.5:::
gnu	privacy_guard	1.2.3	cpe:/a:gnu:privacy_guard:1.2.3:::
gnu	privacy_guard	1.0.2	cpe:/a:gnu:privacy_guard:1.0.2:::
gnu	privacy_guard	1.2.2	cpe:/a:gnu:privacy_guard:1.2.2:::
gnu	privacy_guard	1.0.7	cpe:/a:gnu:privacy_guard:1.0.7:::
gnu	privacy_guard	1.2	cpe:/a:gnu:privacy_guard:1.2:::
gnu	privacy_guard	1.0.4	cpe:/a:gnu:privacy_guard:1.0.4:::
gnu	privacy_guard	1.2.1	cpe:/a:gnu:privacy_guard:1.2.1:::