SB2018060901 - Spoofing attack in gnupg (Alpine package)

Description

This security bulletin contains information about 1 vulnerability.

1) Spoofing attack (CVE-ID: CVE-2018-12020)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to conduct spoofing attack.

The vulnerability exists due to an input validation flaw in the processing of filenames when displaying the filename. A remote attacker can send a signed and encrypted email message that includes the specially crafted name of the original input file, spoof status messages and fake the verification status of a signed email message.

Remediation

Install update from vendor's website.

References

• https://git.alpinelinux.org/aports/commit/?id=e9819d25dc53379d45514e53f91014181e306ec3
• https://git.alpinelinux.org/aports/commit/?id=dc810e708ca64228344ca9d249529e253ad1ea71
• https://git.alpinelinux.org/aports/commit/?id=94ffa605a4208f620a3f267dd8c13bf7958d1e30
• https://git.alpinelinux.org/aports/commit/?id=6895452f9306041d563023e9fae6b77ac6c27dae
• https://git.alpinelinux.org/aports/commit/?id=0b8633cb1937c48694aa242de13894fced453c9c
• https://git.alpinelinux.org/aports/commit/?id=55b2d09fd223c0437d28cc753f4e4f6435af6e2f
• https://git.alpinelinux.org/aports/commit/?id=b653afac12d9d1c926afa8c77920e3d827b98422
• https://git.alpinelinux.org/aports/commit/?id=d159a02c3e2473f94a17f38922f25943b00469af
• https://git.alpinelinux.org/aports/commit/?id=054c992d4617419ced8178b89654f0fe6aca7ef0
• https://git.alpinelinux.org/aports/commit/?id=138026298fb799a7a6478e40b3d1e03a051a322c
• https://git.alpinelinux.org/aports/commit/?id=7a15f5277c131da11081bea9a0077891e58ac0fb
• https://git.alpinelinux.org/aports/commit/?id=f98e469b6d7abeef7b518467b71cd523b0dbc6e1
• https://git.alpinelinux.org/aports/commit/?id=f45f736bd7ab32c7b5f903aaf3d56327cf215685