Unscored CVE-2001-0072 EUVD-2001-0072GHSA-7774-m57j-3qmq

gpg (aka GnuPG) 1.0.4 and other versions imports both public and private keys from public key servers without notifying the user about the …

Published May 7, 2001 · Updated Aug 8, 2024 · Assigned by mitre

Description

gpg (aka GnuPG) 1.0.4 and other versions imports both public and private keys from public key servers without notifying the user about the private keys, which could allow an attacker to break the web of trust.

References

CLA-2000:368 vendor-advisory
DSA-010-1 vendor-advisory
MDKSA-2000-087 vendor-advisory
2153 vdb-entry
RHSA-2000:131 vendor-advisory
gnupg-reveal-private(5803) vdb-entry
20001220 Trustix Security Advisory - gnupg, ftpd-BSD mailing-list
1702 vdb-entry