Skip to content
OpenAdvisories
High USN-4839-1 2 CVEs

python-gnupg vulnerabilities

Published Mar 15, 2021 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

Marcus Brinkmann discovered that python-gnupg improperly handled certain
command line parameters. A remote attacker could use this to spoof the
output of python-gnupg and cause unsigned e-mail to appear signed.
(CVE-2018-12020)

It was discovered that python-gnupg incorrectly handled the GPG passphrase.
A remote attacker could send a specially crafted passphrase that would
allow them to control the output of encryption and decryption operations.
(CVE-2019-6690)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS python-gnupg 0.3.6-1ubuntu0.1~esm1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS python-gnupg 0.3.8-2ubuntu0.1~esm1

Vulnerabilities 2

  • High 7.5
    CVE-2019-6690 Public exploit

    Improper Input Validation python-gnupg

    python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Impr…

    python-gnupg python-gnupg python-gnupg Debian Ubuntu PyPI
  • Unscored —
    CVE-2018-12020

    mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which all…

    gnupg2 gnupg2 gnupg enigmail Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2018-12020
  • report
    https://ubuntu.com/security/CVE-2019-6690