CVE-2019-6690: Input Validation
Last updated 18 August 2025
Other sources
python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting the affect functionality component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/python-gnupgto a version that resolves this vulnerability.Fixed in 0.4.4 - Upgrade
Upgrade
debian/python-gnupgto a version that resolves this vulnerability.Fixed in 0.4.6-1Fixed in 0.4.9-1Fixed in 0.5.4-1 - Upgrade
Upgrade
python-gnupgto a version that resolves this vulnerability.Fixed in 0.4.3
Event History
Frequently Asked Questions
What is the severity of CVE-2019-6690?
The severity of CVE-2019-6690 is high with a CVSS score of 7.5.
What is the affected software version of CVE-2019-6690?
The affected software version of CVE-2019-6690 is python-gnupg 0.4.3.
How can an attacker exploit CVE-2019-6690?
An attacker can exploit CVE-2019-6690 by tricking gnupg to decrypt other ciphertext than intended.
What is the remedy for CVE-2019-6690?
The remedy for CVE-2019-6690 is to upgrade to python-gnupg version 0.4.4 or higher.
What is CWE-20?
CWE-20 is a category of weaknesses related to improper input validation.