Description
GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gnupg2 | 2.0.3-1 | — |
| Debian 14 | gpgme1.0 | 1.1.2-3 | — |
| Debian 13 | gnupg2 | 2.0.3-1 | — |
| Debian 13 | gpgme1.0 | 1.1.2-3 | — |
| Debian 12 | gnupg2 | 2.0.3-1 | — |
| Debian 12 | gpgme1.0 | 1.1.2-3 | — |
| Debian 3.1 | gnupg | 1.4.1-1.sarge7 | DSA-1266-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | gnupg | 1.4.5-13 | RHSA-2007:0107 |
| RHEL 4 | gnupg | 1.2.6-9 | RHSA-2007:0106 |
| RHEL 3 | gnupg | 1.2.1-20 | RHSA-2007:0106 |
| RHEL 2 | gnupg | 1.0.7-21 | RHSA-2007:0106 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- GnuPG 1.x - Signed Message Arbitrary Content Injection EDB-29689 · remote · Mar 5, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2007:0106 Red Hat Security Advisory: gnupg security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0107 Red Hat Security Advisory: gnupg security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1266-1 gnupg - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://issues.rpath.com/browse/RPL-1111
- 2007-0009 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-144.htm
- FEDORA-2007-315 vendor-advisory
- 24407 third-party-advisory
- [gnupg-users] 20070306 [Announce] Multiple Messages Problem in GnuPG and GPGME mailing-list
- 24438 third-party-advisory
- FEDORA-2007-316 vendor-advisory
- 24650 third-party-advisory
- oval:org.mitre.oval:def:10496 vdb-entry signature
- 2353 third-party-advisory
- RHSA-2007:0107 vendor-advisory
- DSA-1266 vendor-advisory
- 20070305 CORE-2007-0115: GnuPG and GnuPG clients unsigned data injection vulnerability mailing-list
- 24511 third-party-advisory
- USN-432-1 vendor-advisory
- http://www.coresecurity.com/?action=item&id=1687
- 20070305 CORE-2007-0115: GnuPG and GnuPG clients unsigned data injection vulnerability mailing-list
- 24734 third-party-advisory
- 24419 third-party-advisory
- 24544 third-party-advisory
- USN-432-2 vendor-advisory
- 24420 third-party-advisory
- 24875 third-party-advisory
- 24365 third-party-advisory
- MDKSA-2007:059 vendor-advisory
- RHSA-2007:0106 vendor-advisory
- 22757 vdb-entry
- 1017727 vdb-entry
- SUSE-SA:2007:024 vendor-advisory
- ADV-2007-0835 vdb-entry
- 24489 third-party-advisory