CVE-2005-0366: Weak Encryption
The integrity check feature in OpenPGP, when handling a message that was encrypted using cipher feedback (CFB) mode, allows remote attackers to recover part of the plaintext via a chosen-ciphertext attack when the first 2 bytes of a message block are known, and an oracle or other mechanism is available to determine whether an integrity check failed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2005-0366?
CVE-2005-0366 is considered a high severity vulnerability due to its potential to allow remote attackers to recover plaintext data.
How do I fix CVE-2005-0366?
To fix CVE-2005-0366, upgrade to a version of GnuPG newer than 1.4.1 that addresses this vulnerability.
What type of attack does CVE-2005-0366 allow?
CVE-2005-0366 allows attackers to perform a chosen-ciphertext attack to recover part of the plaintext of encrypted messages.
Which versions of GnuPG are affected by CVE-2005-0366?
CVE-2005-0366 affects GnuPG versions up to but not including 1.4.1.
What is the cause of CVE-2005-0366?
CVE-2005-0366 is caused by weaknesses in the integrity check feature when handling messages encrypted with cipher feedback mode.