CVE-2018-12020

NameCVE-2018-12020
Descriptionmainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-4222-1, DSA-4223-1, DSA-4224-1
Debian Bugs901088

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
enigmail (PTS)jessie (security), jessie2:1.9.9-1~deb8u1vulnerable
stretch (security), stretch2:1.9.9-1~deb9u1vulnerable
sid2:2.0.7-6fixed
gnupg (PTS)jessie (security), jessie1.4.18-7+deb8u5fixed
gnupg1 (PTS)stretch1.4.21-4vulnerable
stretch (security)1.4.21-4+deb9u1fixed
buster, sid1.4.23-1fixed
gnupg2 (PTS)jessie (security), jessie2.0.26-6+deb8u2fixed
stretch2.1.18-8~deb9u1vulnerable
stretch (security)2.1.18-8~deb9u2fixed
buster, sid2.2.8-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
enigmailsource(unstable)2:2.0.7-1
gnupgsource(unstable)(unfixed)
gnupgsourcejessie1.4.18-7+deb8u5DSA-4224-1
gnupg1source(unstable)1.4.22-5901088
gnupg1sourcestretch1.4.21-4+deb9u1DSA-4223-1
gnupg2source(unstable)2.2.8-1
gnupg2sourcejessie2.0.26-6+deb8u2DSA-4222-1
gnupg2sourcestretch2.1.18-8~deb9u2DSA-4222-1

Notes

https://dev.gnupg.org/T4012
https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html
https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=210e402acd3e284b32db1901e43bf1470e659e49 (STABLE-BRANCH-2-2)
https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=2326851c60793653069494379b16d84e4c10a0ac (STABLE-BRANCH-1-4)
http://www.openwall.com/lists/oss-security/2018/06/13/10
https://neopg.io/blog/gpg-signature-spoof/

Search for package or bug name: Reporting problems