CVE-2018-1000858

NameCVE-2018-1000858
DescriptionGnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Disclosure, DoS. This attack appear to be exploitable via Victim must perform a WKD request, e.g. enter an email address in the composer window of Thunderbird/Enigmail. This vulnerability appears to have been fixed in after commit 4a4bb874f63741026bd26264c43bb32b1099f060.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gnupg (PTS)jessie (security), jessie1.4.18-7+deb8u5fixed
gnupg1 (PTS)stretch (security), stretch1.4.21-4+deb9u1fixed
bullseye, sid, buster1.4.23-1fixed
gnupg2 (PTS)jessie (security), jessie2.0.26-6+deb8u2fixed
stretch2.1.18-8~deb9u4vulnerable
stretch (security)2.1.18-8~deb9u2vulnerable
buster2.2.12-1+deb10u1fixed
bullseye, sid2.2.17-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gnupgsource(unstable)(not affected)
gnupg1source(unstable)(not affected)
gnupg2source(unstable)2.2.12-1
gnupg2sourcejessie(not affected)

Notes

[stretch] - gnupg2 <no-dsa> (Minor issue)
[jessie] - gnupg2 <not-affected> (Vulnerable code was introduced later)
- gnupg1 <not-affected> (Vulnerable code introduced in 2.x in 2.1.12)
- gnupg <not-affected> (Vulnerable code introduced in 2.x in 2.1.12)
WKD (Web Key Directory) feature introduced in 2.1.12
https://sektioneins.de/en/advisories/advisory-012018-gnupg-wkd.html
https://sektioneins.de/en/blog/18-11-23-gnupg-wkd.html
https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=fa1b1eaa4241ff3f0634c8bdf8591cbc7c464144 (master)
https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=4a4bb874f63741026bd26264c43bb32b1099f060 (2.2.12)

Search for package or bug name: Reporting problems