CVE-2018-12020

NameCVE-2018-12020
Descriptionmainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2862-1, DSA-4222-1, DSA-4223-1, DSA-4224-1
Debian Bugs901088

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
enigmail (PTS)buster2:2.2.4-0.2~deb10u1fixed
buster (security)2:2.1.3+ds1-4~deb10u2fixed
sid, bullseye2:2.2.4-0.3fixed
gnupg1 (PTS)buster1.4.23-1fixed
trixie, bookworm, bullseye1.4.23-1.1fixed
sid1.4.23-2fixed
gnupg2 (PTS)buster, buster (security)2.2.12-1+deb10u2fixed
bullseye (security), bullseye2.2.27-2+deb11u2fixed
trixie, bookworm2.2.40-1.1fixed
sid2.2.40-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
enigmailsourcejessie(unfixed)end-of-life
enigmailsource(unstable)2:2.0.7-1
gnupgsourcejessie1.4.18-7+deb8u5DSA-4224-1
gnupgsource(unstable)(unfixed)
gnupg1sourcestretch1.4.21-4+deb9u1DSA-4223-1
gnupg1source(unstable)1.4.22-5901088
gnupg2sourcejessie2.0.26-6+deb8u2DSA-4222-1
gnupg2sourcestretch2.1.18-8~deb9u2DSA-4222-1
gnupg2source(unstable)2.2.8-1
python-gnupgsourcestretch0.3.9-1+deb9u1DLA-2862-1

Notes

[jessie] - enigmail <end-of-life> (see https://lists.debian.org/debian-lts-announce/2019/02/msg00002.html)
https://dev.gnupg.org/T4012
https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html
https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=210e402acd3e284b32db1901e43bf1470e659e49 (STABLE-BRANCH-2-2)
https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=2326851c60793653069494379b16d84e4c10a0ac (STABLE-BRANCH-1-4)
https://www.openwall.com/lists/oss-security/2018/06/13/10
https://neopg.io/blog/gpg-signature-spoof/

Search for package or bug name: Reporting problems