CVE-2001-0072 gpg (aka GnuPG) 1.0.4 and other versions imports both public and private keys from public key servers without notifying the user about the private keys, which could allow an attacker to break the web....
MediumCVSS 5.0
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
gpg (aka GnuPG) 1.0.4 and other versions imports both public and private keys from public key servers without notifying the user about the private keys, which could allow an attacker to break the web of trust.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU privacy guard | = 1.0 | No fix listed |
| GNU privacy guard | = 1.0.1 | No fix listed |
| GNU privacy guard | = 1.0.2 | No fix listed |
| GNU privacy guard | = 1.0.3 | No fix listed |
| GNU privacy guard | = 1.0.3b | No fix listed |
References
- CLA-2000:368 vendor-advisory
- DSA-010-1 vendor-advisory
- MDKSA-2000-087 vendor-advisory
- 1702 vdb-entry
- RHSA-2000:131 vendor-advisory
- 20001220 Trustix Security Advisory - gnupg, ftpd-BSD mailing-list
- 2153 patch vdb-entry vendor-advisory
- gnupg-reveal-private(5803) vdb-entry