rhsa-2013_1458
Vulnerability from csaf_redhat
Published
2013-10-24 15:16
Modified
2024-11-22 07:13
Summary
Red Hat Security Advisory: gnupg security update

Notes

Topic
An updated gnupg package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
Details
The GNU Privacy Guard (GnuPG or GPG) is a tool for encrypting data and creating digital signatures, compliant with the proposed OpenPGP Internet standard and the S/MIME standard. It was found that GnuPG was vulnerable to the Yarom/Falkner flush+reload cache side-channel attack on the RSA secret exponent. An attacker able to execute a process on the logical CPU that shared the L3 cache with the GnuPG process (such as a different local user or a user of a KVM guest running on the same host with the kernel same-page merging functionality enabled) could possibly use this flaw to obtain portions of the RSA secret key. (CVE-2013-4242) A denial of service flaw was found in the way GnuPG parsed certain compressed OpenPGP packets. An attacker could use this flaw to send specially crafted input data to GnuPG, making GnuPG enter an infinite loop when parsing data. (CVE-2013-4402) It was found that importing a corrupted public key into a GnuPG keyring database corrupted that keyring. An attacker could use this flaw to trick a local user into importing a specially crafted public key into their keyring database, causing the keyring to be corrupted and preventing its further use. (CVE-2012-6085) It was found that GnuPG did not properly interpret the key flags in a PGP key packet. GPG could accept a key for uses not indicated by its holder. (CVE-2013-4351) Red Hat would like to thank Werner Koch for reporting the CVE-2013-4402 issue. Upstream acknowledges Taylor R Campbell as the original reporter. All gnupg users are advised to upgrade to this updated package, which contains backported patches to correct these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated gnupg package that fixes multiple security issues is now\navailable for Red Hat Enterprise Linux 5.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The GNU Privacy Guard (GnuPG or GPG) is a tool for encrypting data and\ncreating digital signatures, compliant with the proposed OpenPGP Internet\nstandard and the S/MIME standard.\n\nIt was found that GnuPG was vulnerable to the Yarom/Falkner flush+reload\ncache side-channel attack on the RSA secret exponent. An attacker able to\nexecute a process on the logical CPU that shared the L3 cache with the\nGnuPG process (such as a different local user or a user of a KVM guest\nrunning on the same host with the kernel same-page merging functionality\nenabled) could possibly use this flaw to obtain portions of the RSA secret\nkey. (CVE-2013-4242)\n\nA denial of service flaw was found in the way GnuPG parsed certain\ncompressed OpenPGP packets. An attacker could use this flaw to send\nspecially crafted input data to GnuPG, making GnuPG enter an infinite loop\nwhen parsing data. (CVE-2013-4402)\n\nIt was found that importing a corrupted public key into a GnuPG keyring\ndatabase corrupted that keyring. An attacker could use this flaw to trick a\nlocal user into importing a specially crafted public key into their keyring\ndatabase, causing the keyring to be corrupted and preventing its further\nuse. (CVE-2012-6085)\n\nIt was found that GnuPG did not properly interpret the key flags in a PGP\nkey packet. GPG could accept a key for uses not indicated by its holder.\n(CVE-2013-4351)\n\nRed Hat would like to thank Werner Koch for reporting the CVE-2013-4402\nissue. Upstream acknowledges Taylor R Campbell as the original reporter.\n\nAll gnupg users are advised to upgrade to this updated package, which\ncontains backported patches to correct these issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2013:1458",
        "url": "https://access.redhat.com/errata/RHSA-2013:1458"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "891142",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=891142"
      },
      {
        "category": "external",
        "summary": "988589",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=988589"
      },
      {
        "category": "external",
        "summary": "1010137",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1010137"
      },
      {
        "category": "external",
        "summary": "1015685",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1015685"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1458.json"
      }
    ],
    "title": "Red Hat Security Advisory: gnupg security update",
    "tracking": {
      "current_release_date": "2024-11-22T07:13:28+00:00",
      "generator": {
        "date": "2024-11-22T07:13:28+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2013:1458",
      "initial_release_date": "2013-10-24T15:16:00+00:00",
      "revision_history": [
        {
          "date": "2013-10-24T15:16:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2013-10-24T15:22:57+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T07:13:28+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
                "product": {
                  "name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
                  "product_id": "5Client-5.10.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:5::client"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux (v. 5 server)",
                "product": {
                  "name": "Red Hat Enterprise Linux (v. 5 server)",
                  "product_id": "5Server-5.10.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:5::server"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gnupg-0:1.4.5-18.el5_10.s390x",
                "product": {
                  "name": "gnupg-0:1.4.5-18.el5_10.s390x",
                  "product_id": "gnupg-0:1.4.5-18.el5_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gnupg@1.4.5-18.el5_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
                "product": {
                  "name": "gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
                  "product_id": "gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gnupg-debuginfo@1.4.5-18.el5_10?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gnupg-0:1.4.5-18.el5_10.src",
                "product": {
                  "name": "gnupg-0:1.4.5-18.el5_10.src",
                  "product_id": "gnupg-0:1.4.5-18.el5_10.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gnupg@1.4.5-18.el5_10?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gnupg-0:1.4.5-18.el5_10.x86_64",
                "product": {
                  "name": "gnupg-0:1.4.5-18.el5_10.x86_64",
                  "product_id": "gnupg-0:1.4.5-18.el5_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gnupg@1.4.5-18.el5_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64",
                "product": {
                  "name": "gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64",
                  "product_id": "gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gnupg-debuginfo@1.4.5-18.el5_10?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gnupg-0:1.4.5-18.el5_10.ia64",
                "product": {
                  "name": "gnupg-0:1.4.5-18.el5_10.ia64",
                  "product_id": "gnupg-0:1.4.5-18.el5_10.ia64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gnupg@1.4.5-18.el5_10?arch=ia64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
                "product": {
                  "name": "gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
                  "product_id": "gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gnupg-debuginfo@1.4.5-18.el5_10?arch=ia64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ia64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gnupg-0:1.4.5-18.el5_10.i386",
                "product": {
                  "name": "gnupg-0:1.4.5-18.el5_10.i386",
                  "product_id": "gnupg-0:1.4.5-18.el5_10.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gnupg@1.4.5-18.el5_10?arch=i386"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
                "product": {
                  "name": "gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
                  "product_id": "gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gnupg-debuginfo@1.4.5-18.el5_10?arch=i386"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i386"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gnupg-0:1.4.5-18.el5_10.ppc",
                "product": {
                  "name": "gnupg-0:1.4.5-18.el5_10.ppc",
                  "product_id": "gnupg-0:1.4.5-18.el5_10.ppc",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gnupg@1.4.5-18.el5_10?arch=ppc"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
                "product": {
                  "name": "gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
                  "product_id": "gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gnupg-debuginfo@1.4.5-18.el5_10?arch=ppc"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnupg-0:1.4.5-18.el5_10.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.i386"
        },
        "product_reference": "gnupg-0:1.4.5-18.el5_10.i386",
        "relates_to_product_reference": "5Client-5.10.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnupg-0:1.4.5-18.el5_10.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.ia64"
        },
        "product_reference": "gnupg-0:1.4.5-18.el5_10.ia64",
        "relates_to_product_reference": "5Client-5.10.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnupg-0:1.4.5-18.el5_10.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.ppc"
        },
        "product_reference": "gnupg-0:1.4.5-18.el5_10.ppc",
        "relates_to_product_reference": "5Client-5.10.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnupg-0:1.4.5-18.el5_10.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.s390x"
        },
        "product_reference": "gnupg-0:1.4.5-18.el5_10.s390x",
        "relates_to_product_reference": "5Client-5.10.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnupg-0:1.4.5-18.el5_10.src as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.src"
        },
        "product_reference": "gnupg-0:1.4.5-18.el5_10.src",
        "relates_to_product_reference": "5Client-5.10.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnupg-0:1.4.5-18.el5_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.x86_64"
        },
        "product_reference": "gnupg-0:1.4.5-18.el5_10.x86_64",
        "relates_to_product_reference": "5Client-5.10.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnupg-debuginfo-0:1.4.5-18.el5_10.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.i386"
        },
        "product_reference": "gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
        "relates_to_product_reference": "5Client-5.10.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnupg-debuginfo-0:1.4.5-18.el5_10.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ia64"
        },
        "product_reference": "gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
        "relates_to_product_reference": "5Client-5.10.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnupg-debuginfo-0:1.4.5-18.el5_10.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ppc"
        },
        "product_reference": "gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
        "relates_to_product_reference": "5Client-5.10.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnupg-debuginfo-0:1.4.5-18.el5_10.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.s390x"
        },
        "product_reference": "gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
        "relates_to_product_reference": "5Client-5.10.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64"
        },
        "product_reference": "gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64",
        "relates_to_product_reference": "5Client-5.10.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnupg-0:1.4.5-18.el5_10.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.i386"
        },
        "product_reference": "gnupg-0:1.4.5-18.el5_10.i386",
        "relates_to_product_reference": "5Server-5.10.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnupg-0:1.4.5-18.el5_10.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.ia64"
        },
        "product_reference": "gnupg-0:1.4.5-18.el5_10.ia64",
        "relates_to_product_reference": "5Server-5.10.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnupg-0:1.4.5-18.el5_10.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.ppc"
        },
        "product_reference": "gnupg-0:1.4.5-18.el5_10.ppc",
        "relates_to_product_reference": "5Server-5.10.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnupg-0:1.4.5-18.el5_10.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.s390x"
        },
        "product_reference": "gnupg-0:1.4.5-18.el5_10.s390x",
        "relates_to_product_reference": "5Server-5.10.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnupg-0:1.4.5-18.el5_10.src as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.src"
        },
        "product_reference": "gnupg-0:1.4.5-18.el5_10.src",
        "relates_to_product_reference": "5Server-5.10.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnupg-0:1.4.5-18.el5_10.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.x86_64"
        },
        "product_reference": "gnupg-0:1.4.5-18.el5_10.x86_64",
        "relates_to_product_reference": "5Server-5.10.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnupg-debuginfo-0:1.4.5-18.el5_10.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.i386"
        },
        "product_reference": "gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
        "relates_to_product_reference": "5Server-5.10.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnupg-debuginfo-0:1.4.5-18.el5_10.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ia64"
        },
        "product_reference": "gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
        "relates_to_product_reference": "5Server-5.10.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnupg-debuginfo-0:1.4.5-18.el5_10.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ppc"
        },
        "product_reference": "gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
        "relates_to_product_reference": "5Server-5.10.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnupg-debuginfo-0:1.4.5-18.el5_10.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.s390x"
        },
        "product_reference": "gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
        "relates_to_product_reference": "5Server-5.10.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64"
        },
        "product_reference": "gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64",
        "relates_to_product_reference": "5Server-5.10.Z"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2012-6085",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2012-12-29T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "891142"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The read_block function in g10/import.c in GnuPG 1.4.x before 1.4.13 and 2.0.x through 2.0.19, when importing a key, allows remote attackers to corrupt the public keyring database or cause a denial of service (application crash) via a crafted length field of an OpenPGP packet.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "GnuPG: read_block() corrupt key input validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.i386",
          "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.ia64",
          "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.ppc",
          "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.s390x",
          "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.src",
          "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.x86_64",
          "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
          "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
          "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
          "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
          "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64",
          "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.i386",
          "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.ia64",
          "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.ppc",
          "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.s390x",
          "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.src",
          "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.x86_64",
          "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
          "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
          "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
          "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
          "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-6085"
        },
        {
          "category": "external",
          "summary": "RHBZ#891142",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=891142"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-6085",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-6085"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6085",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6085"
        }
      ],
      "release_date": "2012-12-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-10-24T15:16:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
          "product_ids": [
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.i386",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.ia64",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.ppc",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.s390x",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.src",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.x86_64",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.i386",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.ia64",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.ppc",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.s390x",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.src",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.x86_64",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:1458"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.i386",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.ia64",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.ppc",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.s390x",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.src",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.x86_64",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.i386",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.ia64",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.ppc",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.s390x",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.src",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.x86_64",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "GnuPG: read_block() corrupt key input validation"
    },
    {
      "cve": "CVE-2013-4242",
      "discovery_date": "2013-07-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "988589"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "GnuPG susceptible to Yarom/Falkner flush+reload cache side-channel attack",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the version of gnupg as shipped with Red Hat Enterprise Linux 5. This issue affects the version of libgcrypt as shipped with Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this issue as having moderate security impact, a future update may address this flaw. More technical details on this flaw are available at https://bugzilla.redhat.com/show_bug.cgi?id=988589#c12",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.i386",
          "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.ia64",
          "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.ppc",
          "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.s390x",
          "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.src",
          "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.x86_64",
          "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
          "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
          "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
          "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
          "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64",
          "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.i386",
          "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.ia64",
          "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.ppc",
          "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.s390x",
          "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.src",
          "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.x86_64",
          "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
          "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
          "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
          "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
          "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4242"
        },
        {
          "category": "external",
          "summary": "RHBZ#988589",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=988589"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4242",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4242"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4242",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4242"
        },
        {
          "category": "external",
          "summary": "http://eprint.iacr.org/2013/448",
          "url": "http://eprint.iacr.org/2013/448"
        }
      ],
      "release_date": "2013-07-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-10-24T15:16:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
          "product_ids": [
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.i386",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.ia64",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.ppc",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.s390x",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.src",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.x86_64",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.i386",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.ia64",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.ppc",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.s390x",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.src",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.x86_64",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:1458"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 1.9,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.i386",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.ia64",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.ppc",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.s390x",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.src",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.x86_64",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.i386",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.ia64",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.ppc",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.s390x",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.src",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.x86_64",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "GnuPG susceptible to Yarom/Falkner flush+reload cache side-channel attack"
    },
    {
      "cve": "CVE-2013-4351",
      "discovery_date": "2013-09-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1010137"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "GnuPG 1.4.x, 2.0.x, and 2.1.x treats a key flags subpacket with all bits cleared (no usage permitted) as if it has all bits set (all usage permitted), which might allow remote attackers to bypass intended cryptographic protection mechanisms by leveraging the subkey.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gnupg: treats no-usage-permitted keys as all-usages-permitted",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.i386",
          "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.ia64",
          "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.ppc",
          "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.s390x",
          "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.src",
          "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.x86_64",
          "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
          "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
          "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
          "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
          "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64",
          "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.i386",
          "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.ia64",
          "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.ppc",
          "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.s390x",
          "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.src",
          "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.x86_64",
          "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
          "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
          "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
          "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
          "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4351"
        },
        {
          "category": "external",
          "summary": "RHBZ#1010137",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1010137"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4351",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4351"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4351",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4351"
        }
      ],
      "release_date": "2013-03-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-10-24T15:16:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
          "product_ids": [
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.i386",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.ia64",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.ppc",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.s390x",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.src",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.x86_64",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.i386",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.ia64",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.ppc",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.s390x",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.src",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.x86_64",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:1458"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 2.6,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.i386",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.ia64",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.ppc",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.s390x",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.src",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.x86_64",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.i386",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.ia64",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.ppc",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.s390x",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.src",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.x86_64",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "gnupg: treats no-usage-permitted keys as all-usages-permitted"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Werner Koch"
          ]
        },
        {
          "names": [
            "Taylor R Campbell"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2013-4402",
      "discovery_date": "2013-10-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1015685"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "GnuPG: infinite recursion in the compressed packet parser DoS",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.i386",
          "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.ia64",
          "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.ppc",
          "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.s390x",
          "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.src",
          "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.x86_64",
          "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
          "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
          "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
          "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
          "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64",
          "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.i386",
          "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.ia64",
          "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.ppc",
          "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.s390x",
          "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.src",
          "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.x86_64",
          "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
          "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
          "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
          "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
          "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4402"
        },
        {
          "category": "external",
          "summary": "RHBZ#1015685",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1015685"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4402",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4402"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4402",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4402"
        }
      ],
      "release_date": "2013-10-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-10-24T15:16:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
          "product_ids": [
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.i386",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.ia64",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.ppc",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.s390x",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.src",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.x86_64",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.i386",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.ia64",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.ppc",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.s390x",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.src",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.x86_64",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:1458"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.i386",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.ia64",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.ppc",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.s390x",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.src",
            "5Client-5.10.Z:gnupg-0:1.4.5-18.el5_10.x86_64",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
            "5Client-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.i386",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.ia64",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.ppc",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.s390x",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.src",
            "5Server-5.10.Z:gnupg-0:1.4.5-18.el5_10.x86_64",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.i386",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ia64",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.ppc",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.s390x",
            "5Server-5.10.Z:gnupg-debuginfo-0:1.4.5-18.el5_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "GnuPG: infinite recursion in the compressed packet parser DoS"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.