Key management errors in GnuPG - CVE-2018-9234

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU12732

Key management errors in GnuPG - CVE-2018-9234

Published: May 15, 2018


Vulnerability identifier: #VU12732
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-9234
CWE-ID: CWE-320
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to missing enforcement of a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey. A remote attacker can gain access to potentially sensitive information.

Affected software

GnuPG
Amazon Linux AMI
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
Fedora
gpg2-debuginfo
gpg2
gpg2-debugsource
gpg2-lang
gnupg2
Dell Secure Connect Gateway
RecoverPoint for VMs
Dell EMC NetWorker vProxy
Dell Data Protection Central

How to mitigate CVE-2018-9234

Install update from vendor's website.

gpg2-debuginfo - update to 2.0.24-9.14.1
gpg2 - update to 2.0.24-9.14.1
gpg2-debugsource - update to 2.0.24-9.14.1
gpg2-lang - update to 2.0.24-9.14.1
gnupg2 - addressed in versions 2.2.6-1.fc26, 2.2.6-1.fc27, 2.2.6-1.fc28
Dell Secure Connect Gateway - update to 5.20.00.10
RecoverPoint for VMs - update to 6.0.SP1.P1
Dell EMC NetWorker vProxy - addressed in versions 19.9.0.4, 19.10
Dell Data Protection Central - update to 19.10.0-4

External References

Related Security Bulletins