VulnerabilityModified
CVE-2013-4351
GnuPG 1.4.x, 2.0.x, and 2.1.x treats a key flags subpacket with all bits cleared (no usage permitted) as if it has all bits set (all usage permitted), which might allow remote attackers to bypass intended cryptographic protection mechanisms by…
MEDIUM 5.8EPSS 2.52%
Does this matter?
Lower severity and a low EPSS score (2.52%). Track it; it rarely justifies an emergency change on its own.
Description
GnuPG 1.4.x, 2.0.x, and 2.1.x treats a key flags subpacket with all bits cleared (no usage permitted) as if it has all bits set (all usage permitted), which might allow remote attackers to bypass intended cryptographic protection mechanisms by leveraging the subkey.
- CVSS 2.0
- 5.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
- EPSS
- 2.52% probability · 84th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-310
- Affected
- gnupg/gnupg
- Source
- secalert@redhat.com
References
- http://lists.opensuse.org/opensuse-updates/2013-10/msg00003.html
- http://lists.opensuse.org/opensuse-updates/2013-10/msg00006.html
- http://rhn.redhat.com/errata/RHSA-2013-1459.html
- http://thread.gmane.org/gmane.comp.encryption.gpg.devel/17712/focus=18138
- http://ubuntu.com/usn/usn-1987-1
- http://www.debian.org/security/2013/dsa-2773
- http://www.debian.org/security/2013/dsa-2774
- http://www.openwall.com/lists/oss-security/2013/09/13/4
- https://bugzilla.redhat.com/show_bug.cgi?id=1010137
- http://lists.opensuse.org/opensuse-updates/2013-10/msg00003.html
- http://lists.opensuse.org/opensuse-updates/2013-10/msg00006.html
- http://rhn.redhat.com/errata/RHSA-2013-1459.html
- http://thread.gmane.org/gmane.comp.encryption.gpg.devel/17712/focus=18138
- http://ubuntu.com/usn/usn-1987-1
- http://www.debian.org/security/2013/dsa-2773
- http://www.debian.org/security/2013/dsa-2774
- http://www.openwall.com/lists/oss-security/2013/09/13/4
- https://bugzilla.redhat.com/show_bug.cgi?id=1010137
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.