CVE-2019-13050
Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG...
Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.
- Record
CVE-2019-13050- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-295
- Updated
- 2026-11-02
CVE List No score
Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.
- Record
CVE-2019-13050- Updated
- 2026-11-02
EUVDEUVD-2019-4610 No score
Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.
- Record
EUVD-2019-4610- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-ch5h-mpfr-fhxh
Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG...
Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.
- Record
GHSA-ch5h-mpfr-fhxh- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-295, CWE-297
- Updated
- 2026-11-02
OSVRHSA-2020:4490
Red Hat Security Advisory: gnupg2 security, bug fix, and enhancement update
- Record
RHSA-2020:4490- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRLSA-2020:4490
Moderate: gnupg2 security, bug fix, and enhancement update
The GNU Privacy Guard (GnuPG or GPG) is a tool for encrypting data and creating digital signatures, compliant with OpenPGP and S/MIME standards.
The following packages have been upgraded to a later upstream version: gnupg2 (2.2.20). (BZ#1663944)
Security Fix(es):
- GnuPG: interaction between the sks-keyserver code and GnuPG allows for a Certificate Spamming Attack which leads to persistent DoS (CVE-2019-13050)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.
- Record
RLSA-2020:4490- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVUBUNTU-CVE-2019-13050
Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.
- Record
UBUNTU-CVE-2019-13050- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVALSA-2020:4490 No score
Moderate: gnupg2 security, bug fix, and enhancement update
The GNU Privacy Guard (GnuPG or GPG) is a tool for encrypting data and creating digital signatures, compliant with OpenPGP and S/MIME standards.
The following packages have been upgraded to a later upstream version: gnupg2 (2.2.20). (BZ#1663944)
Security Fix(es):
- GnuPG: interaction between the sks-keyserver code and GnuPG allows for a Certificate Spamming Attack which leads to persistent DoS (CVE-2019-13050)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2020:4490- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1917-1 No score
Security update for gpg2
This update for gpg2 fixes the following issues:
Security issue fixed:
- CVE-2019-13050: Fixed a denial of service attacks via big keys (bsc#1141093).
Non-security issue fixed:
- Allow coredumps in X11 desktop sessions (bsc#1124847)
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:1917-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:2006-1 No score
Security update for gpg2
This update for gpg2 fixes the following issues:
Security issue fixed:
- CVE-2019-13050: Fixed a denial of service attacks via big keys (bsc#1141093).
Non-security issue fixed:
- Allow coredumps in X11 desktop sessions (bsc#1124847)
- Record
SUSE-SU-2019:2006-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:2480-1 No score
Security update for gpg2
This update for gpg2 fixes the following issues:
Security issue fixed:
- CVE-2019-13050: Fixed denial-of-service attacks via big keys. (bsc#1141093)
Non-security issue fixed:
- Allow coredumps in X11 desktop sessions (bsc#1124847).
- Record
SUSE-SU-2019:2480-1- Updated
- 2026-11-02
OSVUSN-5431-1 No score
gnupg2 vulnerability
It was discovered that GnuPG was not properly processing keys with large amounts of signatures. An attacker could possibly use this issue to cause a denial of service.
- Record
USN-5431-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gnupg2AlmaLinux:8 From an advisory covering 2 CVEs |
before 2.2.20-2.el8 | 2.2.20-2.el8 |
gnupg2-smimeAlmaLinux:8 From an advisory covering 2 CVEs |
before 2.2.20-2.el8 | 2.2.20-2.el8 |
gnupg2Red Hat:enterprise_linux:8::baseos From an advisory covering 2 CVEs |
before 0:2.2.20-2.el8 | 0:2.2.20-2.el8 |
gnupg2-debuginfoRed Hat:enterprise_linux:8::baseos From an advisory covering 2 CVEs |
before 0:2.2.20-2.el8 | 0:2.2.20-2.el8 |
gnupg2-debugsourceRed Hat:enterprise_linux:8::baseos From an advisory covering 2 CVEs |
before 0:2.2.20-2.el8 | 0:2.2.20-2.el8 |
gnupg2-smimeRed Hat:enterprise_linux:8::baseos From an advisory covering 2 CVEs |
before 0:2.2.20-2.el8 | 0:2.2.20-2.el8 |
gnupg2-smime-debuginfoRed Hat:enterprise_linux:8::baseos From an advisory covering 2 CVEs |
before 0:2.2.20-2.el8 | 0:2.2.20-2.el8 |
gnupg2Rocky Linux:8 From an advisory covering 2 CVEs |
before 0:2.2.20-2.el8 | 0:2.2.20-2.el8 |
gpg2SUSE:Linux Enterprise Module for Basesystem 15 |
before 2.2.5-4.11.1 | 2.2.5-4.11.1 |
gpg2SUSE:Linux Enterprise Module for Basesystem 15 SP1 |
before 2.2.5-4.11.1 | 2.2.5-4.11.1 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gpg2SUSE:Linux Enterprise Desktop 12 SP4 |
before 2.0.24-9.8.1 | 2.0.24-9.8.1 |
gpg2SUSE:Linux Enterprise Server 12 SP4 |
before 2.0.24-9.8.1 | 2.0.24-9.8.1 |
gpg2SUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 2.0.24-9.8.1 | 2.0.24-9.8.1 |
gnupgUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.4.14-1ubuntu21.4.15-1.1ubuntu11.4.15-1.1ubuntu21.4.15-2ubuntu11.4.16-1ubuntu1 Show 8 moreShow less1.4.16-1ubuntu21.4.16-1ubuntu2.11.4.16-1ubuntu2.31.4.16-1ubuntu2.41.4.16-1ubuntu2.51.4.16-1ubuntu2.61.4.16-1ubuntu2.6+esm11.4.16-1ubuntu2.6+esm2 |
None known |
gnupgUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.4.18-7ubuntu11.4.19-6ubuntu11.4.20-1ubuntu11.4.20-1ubuntu21.4.20-1ubuntu3 Show 5 moreShow less1.4.20-1ubuntu3.11.4.20-1ubuntu3.21.4.20-1ubuntu3.31.4.20-1ubuntu3.3+esm21.4.20-1ubuntu3.3+esm3 |
None known |
gnupg2Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.0.28-3ubuntu12.0.28-3ubuntu22.1.11-6ubuntu12.1.11-6ubuntu22.1.11-6ubuntu2.12.1.11-6ubuntu2.1+esm12.1.11-6ubuntu2.1+esm22.1.11-6ubuntu2.1+esm3 |
None known |
sksUbuntu:16.04:LTS |
All versions, plus listed versions 1.1.5-41.1.5-4build11.1.5-4build2 |
None known |
gnupg2Ubuntu:18.04:LTS |
before 2.2.4-1ubuntu1.5, plus listed versions 2.1.15-1ubuntu82.2.4-1ubuntu12.2.4-1ubuntu1.12.2.4-1ubuntu1.22.2.4-1ubuntu1.32.2.4-1ubuntu1.4 |
2.2.4-1ubuntu1.5 |
sksUbuntu:18.04:LTS |
All versions, plus listed versions 1.1.6-131.1.6-14 |
None known |
sksUbuntu:20.04:LTS |
All versions, plus listed versions 1.1.6-14 |
None known |
gpg2openSUSE:Leap 15.0 |
before 2.2.5-lp151.6.3.1 | 2.2.5-lp151.6.3.1 |
gpg2openSUSE:Leap 15.1 |
before 2.2.5-lp151.6.3.1 | 2.2.5-lp151.6.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-13050 is a high vulnerability (CVSS 7.5) in Gnupg, published June 29, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.54%, the 85th percentile. Fixed in gpg2 2.2.5-4.11.1.
References
gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f
lists.gnupg.org/pipermail/gnupg-announce/2019q3/000439.html
twitter.com/lambdafu/status/1147162583969009664
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CP4ON34YEXEZDZOXXWV43KVGGO6WZLJ5
lists.opensuse.org/opensuse-security-announce/2019-08/msg00039.html
Show 38 moreShow less
support.f5.com/csp/article/K08654551
lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2019-13050
github.com/advisories/GHSA-ch5h-mpfr-fhxh
errata.almalinux.org/8/ALSA-2020-4490.html
vulners.com/cve/CVE-2018-1000858
access.redhat.com/errata/RHSA-2020:4490
bugzilla.redhat.com/show_bug.cgi?id=1726146
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4490.json
cve.org/CVERecord?id=CVE-2018-1000858
errata.rockylinux.org/RLSA-2020:4490
suse.com/support/update/announcement/2019/suse-su-20192006-1
bugzilla.suse.com/1124847
ubuntu.com/security/CVE-2019-13050
tech.michaelaltfield.net/2019/07/14/mitigating-poisoned-pgp-certificates