Marcus Brinkmann discovered that during decryption or verification, GnuPG did not properly filter out terminal sequences when reporting the original filename. An attacker could use this to specially craft a file that would cause an application parsing GnuPG output to incorrectly interpret the status of the cryptographic operation reported by GnuPG. (CVE-2018-12020)
Lance Vick discovered that GnuPG did not enforce configurations where key certification required an offline primary Certify key. An attacker with access to a signing subkey could generate certifications that appeared to be valid. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-9234)
{ "binaries": [ { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "dirmngr" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gnupg" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gnupg-agent" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gnupg-l10n" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gnupg-utils" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gnupg2" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gpg" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gpg-agent" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gpg-wks-client" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gpg-wks-server" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gpgconf" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gpgsm" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gpgv" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gpgv-static" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gpgv-win32" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gpgv2" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "scdaemon" } ], "availability": "No subscription required" }
{ "cves_map": { "cves": [ { "severity": [ { "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "type": "CVSS_V3" }, { "score": "low", "type": "Ubuntu" } ], "id": "CVE-2018-9234" }, { "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "type": "CVSS_V3" }, { "score": "medium", "type": "Ubuntu" } ], "id": "CVE-2018-12020" } ], "ecosystem": "Ubuntu:18.04:LTS" } }