CVE-2003-0971 GnuPG (GPG) 1.0.2, and other versions up to 1.2.3, creates ElGamal type 20 (sign+encrypt) keys using the same key component for encryption as for signing, which allows attackers to determine the priva...
MediumCVSS 5.0
EPSS 3.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
GnuPG (GPG) 1.0.2, and other versions up to 1.2.3, creates ElGamal type 20 (sign+encrypt) keys using the same key component for encryption as for signing, which allows attackers to determine the private key from a signature.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU privacy guard | = 1.0.2 | No fix listed |
| GNU privacy guard | = 1.0.3 | No fix listed |
| GNU privacy guard | = 1.0.3b | No fix listed |
| GNU privacy guard | = 1.0.4 | No fix listed |
| GNU privacy guard | = 1.0.5 | No fix listed |
| GNU privacy guard | = 1.0.6 | No fix listed |
| GNU privacy guard | = 1.0.7 | No fix listed |
| GNU privacy guard | = 1.2 | No fix listed |
| GNU privacy guard | = 1.2.1 | No fix listed |
| GNU privacy guard | = 1.2.2 | No fix listed |
| GNU privacy guard | = 1.2.2-rc1 | No fix listed |
| GNU privacy guard | = 1.2.3 | No fix listed |
References
- CLA-2003:798 vendor-advisory
- lists.gnupg.org patch vendor-advisory
- lists.gnupg.org patch
- 20031127 GnuPG's ElGamal signing keys compromised mailing-list
- 10304 third-party-advisory
- 10349 third-party-advisory
- 10399 third-party-advisory
- 10400 third-party-advisory
- DSA-429 vendor-advisory
- VU#940388 third-party-advisory us-government-resource
- MDKSA-2003:109 vendor-advisory
- SuSE-SA:2003:048 vendor-advisory
- RHSA-2003:390 vendor-advisory
- RHSA-2003:395 vendor-advisory
- 9115 patch vdb-entry vendor-advisory
- oval:org.mitre.oval:def:10982 signature vdb-entry