REDHAT-BUG-2127010: Low severity gnupg 2 (gnu privacy guard) vulnerability

Published Sep 15, 2022

Updated

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB; see $URL and the surrounding email threads for more details and test-cases.

The reporter has some proposed patches at https://dev.gnupg.org/D556 (and in oss-security / gnupg-devel threads); mostly these flag/reject compressed packets and indeterminate-length packets in contexts where they make no sense and arguably are not within the spec (certificates, keys, detached signatures).

Affected Software

1 affected component

gnupg GnuPG

Event History

Sep 15, 2022

Data Sourced

via Red Hat·05:01 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2127010?

The severity of REDHAT-BUG-2127010 is not explicitly defined but may cause performance issues due to GnuPG spinning on crafted inputs.

How do I fix REDHAT-BUG-2127010?

To fix REDHAT-BUG-2127010, apply the proposed patches provided by the vulnerability reporter.

What impact does REDHAT-BUG-2127010 have on GnuPG functionality?

REDHAT-BUG-2127010 can lead to significant performance degradation when processing specially crafted public keys.

Is there a workaround for REDHAT-BUG-2127010?

Currently, there is no official workaround for REDHAT-BUG-2127010.

What versions of GnuPG are affected by REDHAT-BUG-2127010?

REDHAT-BUG-2127010 affects GnuPG software, but specific version details are not provided in the report.