CVE-2018-12020: High severity redhat Enterprise Linux Desktop vulnerability
GnuPG before version 2.2.8 does not properly sanitize original filenames of signed or encrypted messages allowing for the insertion of line feeds and other control characters. An attacker could exploit this by injecting such characters to craft status messages and fake the validity of signatures.
External Reference:
https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html
Upstream Issue:
https://dev.gnupg.org/T4012
Upstream Patches:
https://dev.gnupg.org/rG2326851c60793653069494379b16d84e4c10a0ac https://dev.gnupg.org/rG210e402acd3e284b32db1901e43bf1470e659e49 https://dev.gnupg.org/rG13f135c7a252cc46cff96e75968d92b6dc8dce1b
Other sources
mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/gnupg2to a version that resolves this vulnerability.Fixed in 2.2.8 - Upgrade
Upgrade
debian/enigmailto a version that resolves this vulnerability.Fixed in 2:2.2.4-0.3 - Upgrade
Upgrade
debian/gnupg1to a version that resolves this vulnerability.Fixed in 1.4.23-1.1Fixed in 1.4.23-3 - Upgrade
Upgrade
debian/gnupg2to a version that resolves this vulnerability.Fixed in 2.2.27-2+deb11u2Fixed in 2.2.27-2+deb11u3Fixed in 2.2.40-1.1+deb12u2Fixed in 2.4.7-21+deb13u1Fixed in 2.4.9-7 - Upgrade
Upgrade
GnuPGto a version that resolves this vulnerability.Fixed in 2.2.8 - Compensating control
If you use GnuPG with the "--status-fd 2" option to drive other programs, treat status output from GnuPG as untrusted and ensure downstream consumers do not accept spoofed GOODSIG/VALIDSIG-style messages generated via unsanitized original filenames (e.g., validate status messages out-of-band before acting on them).
Event History
Frequently Asked Questions
What is the severity of CVE-2018-12020?
CVE-2018-12020 is considered a moderate severity vulnerability as it can lead to signature forgery.
How do I fix CVE-2018-12020?
To fix CVE-2018-12020, update GnuPG to version 2.2.8 or later.
What systems are affected by CVE-2018-12020?
CVE-2018-12020 affects GnuPG versions prior to 2.2.8 and numerous distributions including Red Hat and Debian.
What type of vulnerability is CVE-2018-12020?
CVE-2018-12020 is an input validation vulnerability related to improper sanitization of filenames.
Can CVE-2018-12020 be exploited remotely?
Yes, CVE-2018-12020 can potentially be exploited remotely through crafted messages that utilize the vulnerability.