CVE-2018-12020

mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output…

published June 8, 2018

CVSS
—
EPSS
8%
Percentile
94.9
In the wild
Unconfirmed
What it is

mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.08247 · 94.9th percentile
Published
2018-06-08T21:00Z
EPSS history
Timeline
  • 08 JUN 21:00Z
    mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output…
    cvelistv5