CVE-2000-0445: Low severity PGP PGP vulnerability
The pgpk command in PGP 5.x on Unix systems uses an insufficiently random data source for non-interactive key pair generation, which may produce predictable keys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not use pgpk's non-interactive key pair generation in PGP 5.x on Unix; generate keys interactively to ensure use of a sufficiently random data source.
PGP (pgpk) on Unix (PGP 5.x) non-interactive key pair generation = disabled - Compensating control
If immediate key rotation is not possible, remove or suspend use of keys created non-interactively with pgpk, restrict their usage for non-critical operations only, and isolate systems used for key generation until secure keys are produced.
- Operational
Treat any OpenPGP keys created non-interactively with pgpk in PGP 5.x on Unix as potentially predictable: revoke or retire those keys, generate new keys via a secure interactive process, and rotate any associated credentials or certificates.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0445?
CVE-2000-0445 has been classified as a moderate severity vulnerability due to the potential for predictable key generations.
How do I fix CVE-2000-0445?
To mitigate CVE-2000-0445, upgrade to a version of PGP that uses a better random data source for key generation.
What versions are affected by CVE-2000-0445?
CVE-2000-0445 affects PGP versions 5.0i and 5.0_linux, as well as 6.5_linux.
What is the impact of CVE-2000-0445 on data security?
The impact of CVE-2000-0445 may lead to the compromise of encrypted data due to the generation of predictable encryption keys.
Is there a workaround for CVE-2000-0445?
While upgrading is the best solution, a temporary workaround is to avoid using the pgpk command for non-interactive key generation.