CVE-2006-0455 gpgv in GnuPG before 1.4.2.1, when using unattended signature verification, returns a 0 exit code in certain cases even when the detached signature file does not carry a signature, which could cause p...
MediumCVSS 4.6
EPSS 1.4%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
gpgv in GnuPG before 1.4.2.1, when using unattended signature verification, returns a 0 exit code in certain cases even when the detached signature file does not carry a signature, which could cause programs that use gpgv to assume that the signature verification has succeeded. Note: this also occurs when running the equivalent command "gpg --verify".
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU privacy guard | = 1.0 | No fix listed |
| GNU privacy guard | = 1.0.1 | No fix listed |
| GNU privacy guard | = 1.0.2 | No fix listed |
| GNU privacy guard | = 1.0.3 | No fix listed |
| GNU privacy guard | = 1.0.3b | No fix listed |
| GNU privacy guard | = 1.0.4 | No fix listed |
| GNU privacy guard | = 1.0.5 | No fix listed |
| GNU privacy guard | = 1.0.6 | No fix listed |
| GNU privacy guard | = 1.0.7 | No fix listed |
| GNU privacy guard | = 1.2 | No fix listed |
| GNU privacy guard | = 1.2.1 | No fix listed |
| GNU privacy guard | = 1.2.2 | No fix listed |
| GNU privacy guard | = 1.2.2-rc1 | No fix listed |
| GNU privacy guard | = 1.2.3 | No fix listed |
| GNU privacy guard | = 1.2.4 | No fix listed |
| GNU privacy guard | = 1.2.5 | No fix listed |
| GNU privacy guard | = 1.2.6 | No fix listed |
| GNU privacy guard | = 1.2.7 | No fix listed |
| GNU privacy guard | = 1.3.3 | No fix listed |
| GNU privacy guard | = 1.3.4 | No fix listed |
| GNU privacy guard | = 1.4 | No fix listed |
| GNU privacy guard | = 1.4.1 | No fix listed |
| GNU privacy guard | = 1.4.2 | No fix listed |
References
- Debian Security Tracker CVE-2006-0455 vendor-advisory
- FEDORA-2006-116 vendor-advisory
- [gnupg-announce] 20060215 False positive signature verification in GnuPG mailing-list
- [gnupg-devel] 20060215 [Announce] False positive signature verification in GnuPG mailing-list
- 18845 third-party-advisory vendor-advisory
- 18933 patch third-party-advisory vendor-advisory
- 18934 patch third-party-advisory vendor-advisory
- 18942 patch third-party-advisory vendor-advisory
- 18955 patch third-party-advisory vendor-advisory
- 18956 patch third-party-advisory vendor-advisory
- 18968 patch third-party-advisory vendor-advisory
- 19130 third-party-advisory vendor-advisory
- 19249 third-party-advisory vendor-advisory
- 19532 third-party-advisory vendor-advisory
- GLSA-200602-10 patch vendor-advisory
- MDKSA-2006:043 vendor-advisory
- SUSE-SR:2006:005 vendor-advisory
- SUSE-SA:2006:009 patch vendor-advisory
- SUSE-SA:2006:013 vendor-advisory
- OpenPKG-SA-2006.001 vendor-advisory
- 23221 vdb-entry
- RHSA-2006:0266 vendor-advisory
- 20060215 False positive signature verification in GnuPG mailing-list
- FLSA-2006:185355 vendor-advisory
- 16663 exploit patch vdb-entry
- SSA:2006-072-02 patch vendor-advisory
- 2006-0008 vendor-advisory
- USN-252-1 vendor-advisory
- DSA-978 patch vendor-advisory
- ADV-2006-0610 vdb-entry vendor-advisory
- gnupg-gpgv-improper-verification(24744) vdb-entry
- oval:org.mitre.oval:def:10084 signature vdb-entry