Description
gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, which allows attackers to inject unsigned data via a data packet that is not associated with a control packet, which causes the check for concatenated signatures to report that the signature is valid, a different vulnerability than CVE-2006-0455.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | gnupg | 1.2.6-3 | RHSA-2006:0266 |
| RHEL 3 | gnupg | 1.2.1-15 | RHSA-2006:0266 |
Advisories 2
- RHSA-2006:0266 Red Hat Security Advisory: gnupg security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-993-2 gnupg - remote Debian Security (DSA / DLA) · Mar 9, 2026
References
- USN-264-1 vendor-advisory
- 19249 third-party-advisory
- ADV-2006-0915 vdb-entry
- RHSA-2006:0266 vendor-advisory
- [gnupg-announce] 20060309 [Announce] GnuPG does not detect injection of unsigned data mailing-list
- 450 third-party-advisory
- 19232 third-party-advisory
- 23790 vdb-entry
- SSA:2006-072-02 vendor-advisory
- 19173 third-party-advisory
- FLSA-2006:185355 vendor-advisory
- 17058 vdb-entry
- 568 third-party-advisory
- oval:org.mitre.oval:def:10063 vdb-entry signature
- 19287 third-party-advisory
- 2006-0014 vendor-advisory
- 1015749 vdb-entry
- 19532 third-party-advisory
- SUSE-SA:2006:014 vendor-advisory
- GLSA-200603-08 vendor-advisory
- gnupg-nondetached-sig-verification(25184) vdb-entry
- 19234 third-party-advisory
- FEDORA-2006-147 vendor-advisory
- 19197 third-party-advisory
- 19244 third-party-advisory
- 19203 third-party-advisory
- MDKSA-2006:055 vendor-advisory
- 20060309 GnuPG does not detect injection of unsigned data mailing-list
- 19231 third-party-advisory
- DSA-993 vendor-advisory