CVE-2022-3219: Low severity gnupg 2 (gnu privacy guard) vulnerability
GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB; see $URL and the surrounding email threads for more details and test-cases.
The reporter has some proposed patches at https://dev.gnupg.org/D556 (and in oss-security / gnupg-devel threads); mostly these flag/reject compressed packets and indeterminate-length packets in contexts where they make no sense and arguably are not within the spec (certificates, keys, detached signatures).
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this GnuPG vulnerability?
The vulnerability ID for this GnuPG vulnerability is CVE-2022-3219.
What is the severity of CVE-2022-3219?
CVE-2022-3219 has a severity rating of low.
How can GnuPG be exploited with this vulnerability?
GnuPG can be made to spin on a relatively small input, such as crafting a public key with thousands of signatures attached.
How can I check if my GnuPG installation is affected by CVE-2022-3219?
You can check if your GnuPG installation is affected by CVE-2022-3219 by checking the version and applying any available patches or updates.
Are there any references available for more information about CVE-2022-3219?
Yes, you can find more information about CVE-2022-3219 at the following references: [link1], [link2], [link3].