CVE-2020-25125

GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker's OpenPGP key, and this key has AEAD preferences. The overflow is caused by a g10/key-check.c error. NOTE: GnuPG 2.3.x is unaffected. GnuPG 2.2.23 is a fixed version.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.2.21"
                },
                {
                    "last_affected": "2.2.21"
                },
                {
                    "introduced": "2.2.22"
                },
                {
                    "last_affected": "2.2.22"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "gnupg:gnupg",
            "cpes": [
                "cpe:2.3:a:gnupg:gnupg:2.2.21:*:*:*:*:*:*:*",
                "cpe:2.3:a:gnupg:gnupg:2.2.22:*:*:*:*:*:*:*"
            ]
        }
    ]
}

References

Affected packages

Git / git.gnupg.org/gpg4win.git

Affected ranges

Type

GIT

Repo

git://git.gnupg.org/gpg4win.git

Events

Introduced

69077578c9cf52633e91b3cce5805fdedd643cc8

Last affected

69077578c9cf52633e91b3cce5805fdedd643cc8

Database specific

{
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:gpg4win:gpg4win:3.1.12:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.1.12"
        },
        {
            "last_affected": "3.1.12"
        }
    ]
}

Affected versions

3.*

3.1.12

gpg4win-3.*

gpg4win-3.1.12

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-25125.json"