CVE-2022-34903

2022-07-0100:00:00

ubuntu.com

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

0.004 Low

EPSS

Percentile

74.4%

JSON

GnuPG through 2.3.6, in unusual situations where an attacker possesses any
secret-key information from a victim’s keyring and other constraints (e.g.,
use of GPGME) are met, allows signature forgery via injection into the
status line.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014157>

Notes

Author	Note
sbeattie	issue may not be as severe in gnupg 1

OSVersionArchitecturePackageVersionFilename
ubuntu14.04noarchgnupg< 1.4.16-1ubuntu2.6+esm1UNKNOWN
ubuntu16.04noarchgnupg< 1.4.20-1ubuntu3.3+esm2UNKNOWN
ubuntu18.04noarchgnupg2< 2.2.4-1ubuntu1.6UNKNOWN
ubuntu20.04noarchgnupg2< 2.2.19-3ubuntu2.2UNKNOWN
ubuntu21.10noarchgnupg2< 2.2.20-1ubuntu4.1UNKNOWN
ubuntu22.04noarchgnupg2< 2.2.27-3ubuntu2.1UNKNOWN
ubuntu16.04noarchgnupg2< 2.1.11-6ubuntu2.1+esm1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	14.04	noarch	gnupg	< 1.4.16-1ubuntu2.6+esm1	UNKNOWN
ubuntu	16.04	noarch	gnupg	< 1.4.20-1ubuntu3.3+esm2	UNKNOWN
ubuntu	18.04	noarch	gnupg2	< 2.2.4-1ubuntu1.6	UNKNOWN
ubuntu	20.04	noarch	gnupg2	< 2.2.19-3ubuntu2.2	UNKNOWN
ubuntu	21.10	noarch	gnupg2	< 2.2.20-1ubuntu4.1	UNKNOWN
ubuntu	22.04	noarch	gnupg2	< 2.2.27-3ubuntu2.1	UNKNOWN
ubuntu	16.04	noarch	gnupg2	< 2.1.11-6ubuntu2.1+esm1	UNKNOWN