Skip to content
OpenAdvisories
High USN-3964-1 2 CVEs

python-gnupg vulnerabilities

Published May 2, 2019 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Marcus Brinkmann discovered that GnuPG before 2.2.8 improperly handled certain
command line parameters. A remote attacker could use this to spoof the output of
GnuPG and cause unsigned e-mail to appear signed.
(CVE-2018-12020)

It was discovered that python-gnupg incorrectly handled the GPG passphrase. A
remote attacker could send a specially crafted passphrase that would allow them
to control the output of encryption and decryption operations.
(CVE-2019-6690)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS python-gnupg 0.4.1-1ubuntu1.18.04.1

Vulnerabilities 2

  • High 7.5
    CVE-2019-6690 Public exploit

    Improper Input Validation python-gnupg

    python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Impr…

    python-gnupg python-gnupg python-gnupg Debian Ubuntu PyPI
  • Unscored —
    CVE-2018-12020

    mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which all…

    gnupg2 gnupg2 gnupg enigmail Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2018-12020
  • report
    https://ubuntu.com/security/CVE-2019-6690