|Description||gpg in GnuPG before 188.8.131.52 does not properly verify non-detached signatures, which allows attackers to inject unsigned data via a data packet that is not associated with a control packet, which causes the check for concatenated signatures to report that the signature is valid, a different vulnerability than CVE-2006-0455.|
|Source||CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)|
Vulnerable and fixed packages
The table below lists information on source packages.
|gnupg2 (PTS)||buster, buster (security)||2.2.12-1+deb10u2||fixed|
|bullseye (security), bullseye||2.2.27-2+deb11u2||fixed|
|sid, trixie, bookworm||2.2.40-1.1||fixed|
The information below is based on the following data on fixed versions.
- gnupg2 <not-affected> (Vulnerable code not activated)