EIQ-2019-0002

EIQ-2019-0002

CVE-2019-6690

Improper input validation in python-gnupg 0.4.3

07 Mar 2019

3 - HIGH

CVSSv3 score not available on NIST NVD.

2.3.4

When symmetric encryption is used, it is possible to inject data through the passphrase property of
the gnupg.GPG.encrypt() and gnupg.GPG.decrypt() methods.

The supplied passphrase is not validated for new lines. The library passes --passphrase-fd=0 to the gpg executable, which expects the
passphrase on the first line of stdin, and the ciphertext to be decrypted or plain text to be encrypted on subsequent lines.

By supplying a passphrase containing a new line an attacker can control and/or modify the ciphertext/plain text being decrypted and/or encrypted.

Update to python-gnupg 0.4.4.

2.1.0 to 2.3.3 included.

For more information, see CVE-2019-6690: Improper Input Validation in python-gnupg.