Summary
It was discovered that GnuPG incorrectly handled importing keys with
certain crafted subkey data. If a user or automated system were tricked
into importing a specially crafted key, a remote attacker may prevent users
from importing other keys in the future.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | gnupg2 | 2.2.19-3ubuntu2.4 |
| Ubuntu · 22.04 LTS 22.04:LTS | gnupg2 | 2.2.27-3ubuntu2.3 |
| Ubuntu · 24.04 LTS 24.04:LTS | gnupg2 | 2.4.4-2ubuntu17.2 |
Vulnerabilities 1
-
Low 2.7
In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid ba…
References
-
report
https://ubuntu.com/security/CVE-2025-30258