CVE-2003-0971: Medium severity gnu privacy guard vulnerability
GnuPG (GPG) 1.0.2, and other versions up to 1.2.3, creates ElGamal type 20 (sign+encrypt) keys using the same key component for encryption as for signing, which allows attackers to determine the private key from a signature.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not create ElGamal type 20 (sign+encrypt) keys in GnuPG; configure key generation to use separate keys for signing and encryption or choose non-ElGamal algorithms.
GnuPG (GPG) ElGamal key generation (type 20 sign+encrypt) = disabled / do not generate - Compensating control
Treat ElGamal type 20 keys created by GnuPG versions up to 1.2.3 as compromised: block or reject their use (for signature verification and decryption) and flag or deny messages associated with such keys until they are replaced.
- Operational
Revoke and replace any ElGamal type 20 (sign+encrypt) keys generated by GnuPG versions 1.0.2 through 1.2.3, as these keys may reuse key components and allow private key recovery.
Event History
Frequently Asked Questions
What is the severity of CVE-2003-0971?
CVE-2003-0971 has a high severity as it allows attackers to deduce the private key from a signature.
How do I fix CVE-2003-0971?
The fix for CVE-2003-0971 is to upgrade GnuPG to version 1.2.4 or later.
What versions of GnuPG are affected by CVE-2003-0971?
CVE-2003-0971 affects GnuPG versions 1.0.2 through 1.2.3.
What type of cryptographic keys are impacted by CVE-2003-0971?
CVE-2003-0971 affects ElGamal type 20 keys which are used for signing and encrypting.
Can CVE-2003-0971 be exploited remotely?
CVE-2003-0971 requires local access, making remote exploitation unlikely.