3.7 LOW
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): HIGH
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): NONE
- Integrity impact (I): NONE
- Availability impact (A): LOW
In GnuPG before 2.5.17, a long signature packet length causes …
In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of service (application crash).
References
- https://www.openwall.com/lists/oss-security/2026/01/27/8
- https://dev.gnupg.org/T8049
- https://www.openwall.com/lists/oss-security/2026/01/27/8
- https://dev.gnupg.org/T8049
- https://www.openwall.com/lists/oss-security/2026/01/27/8
- https://dev.gnupg.org/T8049
- https://www.openwall.com/lists/oss-security/2026/01/27/8
- https://dev.gnupg.org/T8049
- https://www.openwall.com/lists/oss-security/2026/01/27/8
- https://dev.gnupg.org/T8049
Affected products
- <2.5.17
Matching in nixpkgs
pkgs.gnupg24
Modern release of the GNU Privacy Guard, a GPL OpenPGP implementation
pkgs.pam_gnupg
Unlock GnuPG keys on login
pkgs.gnupg1compat
Modern release of the GNU Privacy Guard, a GPL OpenPGP implementation with symbolic links for gpg and gpgv
pkgs.gnupg-pkcs11-scd
Smart-card daemon to enable the use of PKCS#11 tokens with GnuPG
-
nixos-unstable pkcs11-scd-0.11.0
- nixpkgs-unstable pkcs11-scd-0.11.0
- nixos-unstable-small pkcs11-scd-0.11.0
pkgs.phpExtensions.gnupg
PHP wrapper for GpgME library that provides access to GnuPG
pkgs.php81Extensions.gnupg
PHP wrapper for GpgME library that provides access to GnuPG
pkgs.php82Extensions.gnupg
PHP wrapper for GpgME library that provides access to GnuPG
pkgs.php83Extensions.gnupg
PHP wrapper for GpgME library that provides access to GnuPG
pkgs.php84Extensions.gnupg
PHP wrapper for GpgME library that provides access to GnuPG
pkgs.sequoia-chameleon-gnupg
Sequoia's reimplementation of the GnuPG interface
pkgs.perlPackages.GnuPGInterface
Supply object methods for interacting with GnuPG
pkgs.perl538Packages.GnuPGInterface
Supply object methods for interacting with GnuPG
pkgs.perl540Packages.GnuPGInterface
Supply object methods for interacting with GnuPG
pkgs.python312Packages.python-gnupg
API for the GNU Privacy Guard (GnuPG)
pkgs.python313Packages.python-gnupg
API for the GNU Privacy Guard (GnuPG)
Package maintainers
-
@stigtsp Stig Palmquist <stig@stig.io>
-
@fpletz Franz Pletz <fpletz@fnordicwalking.de>
-
@philandstuff Philip Potter <philip.g.potter@gmail.com>
-
@matthiasbeyer Matthias Beyer <mail@beyermatthias.de>
-
@mtreca Maxime Tréca <maxime.treca@gmail.com>
-
@aanderse Aaron Andersen <aaron@fosslib.net>
-
@Ma27 Maximilian Bosch <maximilian@mbosch.me>
-
@piotrkwiecinski Piotr Kwiecinski <piokwiecinski+nixpkgs@gmail.com>
-
@talyz Kim Lindberger <kim.lindberger@gmail.com>
-
@NickCao Nick Cao <nickcao@nichi.co>