Input validation error in GnuPG - CVE-2010-2547

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU32850

Input validation error in GnuPG - CVE-2010-2547

Published: August 5, 2010 / Updated: July 28, 2020


Vulnerability identifier: #VU32850
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2010-2547
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows remote attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (crash) and possibly execute arbitrary code via a certificate with a large number of Subject Alternate Names, which is not properly handled in a realloc operation when importing the certificate or verifying its signature.


Affected software

GnuPG
Gentoo Linux
Ubuntu
Slackware Linux
Magento Open Source
gnupg (Alpine package)
gpgsm (Ubuntu package)

How to mitigate CVE-2010-2547

Update to version 2.0.17.

GnuPG - update to 2.0.17
gnupg (Alpine package) - update to 2.0.18-r0
gpgsm (Ubuntu package) - addressed in versions 2.0.7-1ubuntu0.1, 2.0.9-3.1ubuntu0.1, 2.0.12-0ubuntu2.1, 2.0.14-1ubuntu1.2

External References

Related Security Bulletins