CVE-2019-6690

python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended

published March 17, 2019

CVSS
—
EPSS
9%
Percentile
95.1
In the wild
Unconfirmed
What it is

python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting the affect functionality component.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.08548 · 95.1th percentile
Published
2019-03-17T17:02Z
EPSS history
Timeline
  • 17 MAR 17:02Z
    python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended
    cvelistv5