CVE-2003-0255
The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys...
The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the greatest validity of the most valid user ID, which prevents GnuPG from warning the encrypting user when a user ID does not have a trusted path.
Exploit likelihood
What each source reports
NVD Score used
The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the greatest validity of the most valid user ID, which prevents GnuPG from warning the encrypting user when a user ID does not have a trusted path.
- Record
CVE-2003-0255- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the greatest validity of the most valid user ID, which prevents GnuPG from warning the encrypting user when a user ID does not have a trusted path.
- Record
CVE-2003-0255- Updated
- 2026-11-02
EUVDEUVD-2003-0250 No score
The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the greatest validity of the most valid user ID, which prevents GnuPG from warning the encrypting user when a user ID does not have a trusted path.
- Record
EUVD-2003-0250- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v66g-8h9c-j8vh No score
The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys...
The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the greatest validity of the most valid user ID, which prevents GnuPG from warning the encrypting user when a user ID does not have a trusted path.
- Record
GHSA-v66g-8h9c-j8vh- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2003-0255 is a high vulnerability (CVSS 10.0) in Gnu Privacy Guard, published May 7, 2003. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.56%, the 93rd percentile. No source names a fixed version.
References
turbolinux.com/security/TLSA-2003-34.txt
redhat.com/support/errata/RHSA-2003-175.html
osvdb.org/4947
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A135
marc.info?l=bugtraq&m=105362224514081&w=2
securityfocus.com/bid/7497
Show 12 moreShow less
linuxsecurity.com/advisories/gentoo_advisory-3266.html
mandriva.com/security/advisories?name=MDKSA-2003:061
exchange.xforce.ibmcloud.com/vulnerabilities/11930
distro.conectiva.com.br/atualizacoes?id=a&anuncio=000694
kb.cert.org/vuls/id/397604
nvd.nist.gov/vuln/detail/CVE-2003-0255
github.com/advisories/GHSA-v66g-8h9c-j8vh