CVE-2018-9234: High severity gnupg GnuPG vulnerability
GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gnupg2to a version that resolves this vulnerability.Fixed in 2.2.27-2+deb11u2Fixed in 2.2.27-2+deb11u3Fixed in 2.2.40-1.1+deb12u2Fixed in 2.4.7-21+deb13u1Fixed in 2.4.9-7
Event History
Frequently Asked Questions
What is the severity of CVE-2018-9234?
The severity of CVE-2018-9234 is high with a severity value of 7.5.
How does CVE-2018-9234 affect GnuPG?
CVE-2018-9234 affects GnuPG versions 2.2.4 and 2.2.5.
What is the recommended remedy for CVE-2018-9234?
The recommended remedy for CVE-2018-9234 is to update GnuPG to version 2.2.6 or higher.
Are there any known exploits or references for CVE-2018-9234?
Yes, you can find more information about CVE-2018-9234 and known exploits or references at the following links: [link1], [link2], [link3].
What is the CWE category for CVE-2018-9234?
The CWE category for CVE-2018-9234 is CWE-320.