CVE-2022-34903: Medium severity gnupg 2 (gnu privacy guard) vulnerability
GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-34903?
CVE-2022-34903 is a vulnerability in GnuPG through version 2.3.6 that allows signature forgery through injection into the status line.
What is the severity of CVE-2022-34903?
The severity of CVE-2022-34903 is medium with a CVSS score of 6.5.
Which software versions are affected by CVE-2022-34903?
GnuPG versions up to and including 2.3.6 are affected by CVE-2022-34903.
How can an attacker exploit CVE-2022-34903?
In unusual situations where the attacker possesses secret-key information from a victim's keyring and other constraints are met, they can exploit CVE-2022-34903 to forge signatures via injection into the status line.
Are there any fixes or patches available for CVE-2022-34903?
Yes, Debian has released patches for the affected versions of GnuPG (gnupg2). Users should update to version 2.2.12-1+deb10u2, 2.2.27-2+deb11u2, or 2.2.40-1.1 to fix CVE-2022-34903.