CVE-2006-0455: Medium severity GNU Privacy Guard vulnerability
gpgv in GnuPG before 1.4.2.1, when using unattended signature verification, returns a 0 exit code in certain cases even when the detached signature file does not carry a signature, which could cause programs that use gpgv to assume that the signature verification has succeeded. Note: this also occurs when running the equivalent command "gpg --verify".
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-0455?
CVE-2006-0455 is considered a medium severity vulnerability due to its potential to mislead programs into assuming a successful signature verification.
How do I fix CVE-2006-0455?
To fix CVE-2006-0455, upgrade to GnuPG version 1.4.2.1 or later, where this issue has been resolved.
What software is affected by CVE-2006-0455?
CVE-2006-0455 affects GnuPG versions prior to 1.4.2.1, specifically versions 1.0 to 1.4.1.
How does CVE-2006-0455 impact digital signature verification?
CVE-2006-0455 can cause gpgv to return a success exit code even when a detached signature file lacks a valid signature, leading to false confidence in security.
Are there workaround solutions for CVE-2006-0455?
While upgrading GnuPG is the best solution for CVE-2006-0455, using additional verification processes outside of gpgv could serve as a temporary workaround.