CVE-2003-0255 The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the greatest validity of the most valid user ID, which prevents GnuPG....
HighCVSS 10.0
EPSS 6.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the greatest validity of the most valid user ID, which prevents GnuPG from warning the encrypting user when a user ID does not have a trusted path.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU privacy guard | <= 1.2.1 | No fix listed |
References
- CLA-2003:694 vendor-advisory
- 20030504 Key validity bug in GnuPG 1.2.1 and earlier mailing-list
- ESA-20030515-016 vendor-advisory
- 20030516 [OpenPKG-SA-2003.029] OpenPKG Security Advisory (gnupg) mailing-list
- 20030522 [slackware-security] GnuPG key validation fix (SSA:2003-141-04) mailing-list
- VU#397604 third-party-advisory us-government-resource
- 20030515-016 vendor-advisory
- www.linuxsecurity.com
- MDKSA-2003:061 vendor-advisory
- 4947 vdb-entry
- RHSA-2003:175 patch vendor-advisory
- RHSA-2003:176 vendor-advisory
- 7497 vdb-entry
- TLSA200334 vendor-advisory
- gnupg-invalid-key-acceptance(11930) vdb-entry
- oval:org.mitre.oval:def:135 signature vdb-entry