CVE-2001-0072: Medium severity gnu privacy guard vulnerability
Published Feb 12, 2001
·Updated
gpg (aka GnuPG) 1.0.4 and other versions imports both public and private keys from public key servers without notifying the user about the private keys, which could allow an attacker to break the web of trust.
Affected Software
5 affected components
GNU Privacy Guard=1.0.3
GNU Privacy Guard=1.0
GNU Privacy Guard=1.0.2
GNU Privacy Guard=1.0.1
GNU Privacy Guard=1.0.3b
Remediation
Patch Available
Event History
Feb 12, 2001
CVE Published
05:00 AM
May 7, 2001
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2001-0072?
CVE-2001-0072 is considered a medium severity vulnerability due to its potential impact on the web of trust.
2
How do I fix CVE-2001-0072?
To mitigate CVE-2001-0072, upgrade GnuPG to the latest version that addresses this issue.
3
What are the affected versions related to CVE-2001-0072?
CVE-2001-0072 affects GnuPG versions 1.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.3b.
4
What could an attacker achieve with CVE-2001-0072?
An attacker could potentially exploit CVE-2001-0072 to disrupt the web of trust by importing unverified private keys.
5
Is user notification affected in CVE-2001-0072?
Yes, CVE-2001-0072 does not notify users about the import of private keys from public key servers.