CVE-2022-34903

GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line.

References

Affected packages

Git /

Affected ranges

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-34903.json"

unresolved_ranges

[
    {
        "events":  [
            {
                "introduced":  "0"
            },
            {
                "last_affected":  "2.3.6"
            }
        ]
    },
    {
        "events":  [
            {
                "introduced":  "0"
            },
            {
                "last_affected":  "35"
            }
        ]
    },
    {
        "events":  [
            {
                "introduced":  "0"
            },
            {
                "last_affected":  "36"
            }
        ]
    },
    {
        "events":  [
            {
                "introduced":  "0"
            },
            {
                "last_affected":  "10.0"
            }
        ]
    },
    {
        "events":  [
            {
                "introduced":  "0"
            },
            {
                "last_affected":  "11.0"
            }
        ]
    }
]