1. CVE-Search
  2. CVE-2003-0255
ID CVE-2003-0255
Summary The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the greatest validity of the most valid user ID, which prevents GnuPG from warning the encrypting user when a user ID does not have a trusted path.
References
Vulnerable Configurations
  • cpe:2.3:a:gnu:privacy_guard:-:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:-:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.0:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.0.7:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.2:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:gnu:privacy_guard:1.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:gnu:privacy_guard:1.2.1:*:*:*:*:*:*:*
CVSS
Base: 10.0 (as of 03-05-2018 - 01:29)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:L/Au:N/C:C/I:C/A:C
oval via4
accepted 2007-04-25T19:52:15.914-04:00
class vulnerability
contributors
  • name Jay Beale
    organization Bastille Linux
  • name Jay Beale
    organization Bastille Linux
  • name Thomas R. Jones
    organization Maitreya Security
description The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the greatest validity of the most valid user ID, which prevents GnuPG from warning the encrypting user when a user ID does not have a trusted path.
family unix
id oval:org.mitre.oval:def:135
status accepted
submitted 2003-08-19T12:00:00.000-04:00
title GnuPG Invalid User ID Vulnerability
version 38
redhat via4
advisories
  • rhsa
    id RHSA-2003:175
  • rhsa
    id RHSA-2003:176
refmap via4
bid 7497
bugtraq
  • 20030504 Key validity bug in GnuPG 1.2.1 and earlier
  • 20030516 [OpenPKG-SA-2003.029] OpenPKG Security Advisory (gnupg)
  • 20030522 [slackware-security] GnuPG key validation fix (SSA:2003-141-04)
cert-vn VU#397604
conectiva CLA-2003:694
engarde
  • 20030515-016
  • ESA-20030515-016
mandrake MDKSA-2003:061
misc http://www.linuxsecurity.com/advisories/gentoo_advisory-3266.html
osvdb 4947
sco CSSA-2003-034.0
turbo TLSA200334
xf gnupg-invalid-key-acceptance(11930)
Last major update 03-05-2018 - 01:29
Published 27-05-2003 - 04:00
Last modified 03-05-2018 - 01:29
Back to Top