DescriptionGnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Disclosure, DoS. This attack appear to be exploitable via Victim must perform a WKD request, e.g. enter an email address in the composer window of Thunderbird/Enigmail. This vulnerability appears to have been fixed in after commit 4a4bb874f63741026bd26264c43bb32b1099f060.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gnupg1 (PTS)buster1.4.23-1fixed
bookworm, bullseye1.4.23-1.1fixed
sid, trixie1.4.23-2fixed
gnupg2 (PTS)buster, buster (security)2.2.12-1+deb10u2fixed
bullseye (security), bullseye2.2.27-2+deb11u2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gnupgsource(unstable)(not affected)
gnupg1source(unstable)(not affected)
gnupg2sourcejessie(not affected)


[stretch] - gnupg2 <no-dsa> (Minor issue)
[jessie] - gnupg2 <not-affected> (Vulnerable code was introduced later)
- gnupg1 <not-affected> (Vulnerable code introduced in 2.x in 2.1.12)
- gnupg <not-affected> (Vulnerable code introduced in 2.x in 2.1.12)
WKD (Web Key Directory) feature introduced in 2.1.12;a=commit;h=fa1b1eaa4241ff3f0634c8bdf8591cbc7c464144 (master);a=commit;h=4a4bb874f63741026bd26264c43bb32b1099f060 (2.2.12)

Search for package or bug name: Reporting problems