{"id":"CVE-2013-4402","aliases":["DEBIAN-CVE-2013-4402","DSA-2773-1","DSA-2774-1","EUVD-2013-4281","GHSA-fhrq-6wcr-78q4","MGASA-2013-0299","MGASA-2013-0303","RHSA-2013:1458","RHSA-2013:1459","openSUSE-SU-2024:10102-1"],"status":"published","title":"The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote...","description":"The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.0503,"percentile":0.92315,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2013-10-09T22:34:30Z","modified":"2026-09-01T20:03:18Z","fixes":[{"ecosystem":"Debian:12","package":"gnupg2","fixed_in":["2.0.22-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gnupg2","fixed_in":["2.0.22-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gnupg2","fixed_in":["2.0.22-1"],"sources":["osv"]},{"ecosystem":"Mageia:2","package":"gnupg","fixed_in":["1.4.12-1.3.mga2"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"gnupg","fixed_in":["1.4.14-1.1.mga3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.22-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.22-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.22-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.10-4+squeeze3"}]}],"versions":["1.4.10-4","1.4.10-4+squeeze1","1.4.10-4+squeeze2"],"bundled":2},{"source":"osv","ecosystem":"Debian:7","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.12-7+deb7u2"}]}],"versions":["1.4.12-7","1.4.12-7+deb7u1"],"bundled":2},{"source":"osv","ecosystem":"Debian:6.0","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-2+squeeze2"}]}],"versions":["2.0.14-2","2.0.14-2+squeeze1"],"bundled":2},{"source":"osv","ecosystem":"Debian:7","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.19-2+deb7u1"}]}],"versions":["2.0.19-2"],"bundled":2},{"source":"osv","ecosystem":"Mageia:2","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.18-1.4.mga2"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:3","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.19-3.2.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:2","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.12-1.3.mga2"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-1.1.mga3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-18.el5_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"gnupg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-18.el5_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-18.el5_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnupg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-18.el5_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.10-6.el5_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"gnupg2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.10-6.el5_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.10-6.el5_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnupg2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.10-6.el5_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-6.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnupg2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-6.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnupg2-smime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-6.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-6.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnupg2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-6.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnupg2-smime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-6.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-6.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnupg2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-6.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnupg2-smime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-6.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-6.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnupg2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-6.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnupg2-smime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-6.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.16-1.1"}]}],"bundled":4}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"gnupg","product":"gnupg"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1015685","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-10/msg00020.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000334.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-1987-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Vendor Advisory","advisory"]},{"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725433","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000333.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.debian.org/security/2013/dsa-2773","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-10/msg00025.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1459.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www.debian.org/security/2013/dsa-2774","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4402","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fhrq-6wcr-78q4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-4402","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0299.html","tags":["advisory"]},{"url":"http://lists.gnu.org/archive/html/info-gnu/2013-10/msg00002.html","tags":["web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-09/msg00058.html","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11306","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2013-0303.html","tags":["advisory"]},{"url":"http://lists.gnu.org/archive/html/info-gnu/2013-10/msg00003.html","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11416","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2013:1458","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=891142","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=988589","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1010137","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1458.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-6085","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-6085","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-6085","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4242","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4242","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4242","tags":["advisory"]},{"url":"http://eprint.iacr.org/2013/448","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4351","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4351","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4351","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4402","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4402","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:1459","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1459.json","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4617","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-4402","description":"The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.","status":"published","published":"2013-10-28T22:00:00Z","modified":"2024-08-06T16:45:14.601Z","updated_at":"2026-11-02T14:34:57.869657Z"}],"euvd":[{"id":"EUVD-2013-4281","description":"The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.","status":"published","published":"2013-10-28T22:00:00Z","modified":"2024-08-06T16:45:14Z","updated_at":"2026-11-03T01:56:32.187151Z"}],"ghsa":[{"id":"GHSA-fhrq-6wcr-78q4","title":"The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote...","description":"The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.","status":"published","published":"2022-05-17T04:55:08Z","modified":"2023-01-28T05:02:56Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:43:52.645209Z"}],"nvd":[{"id":"CVE-2013-4402","description":"The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.","status":"published","published":"2013-10-28T22:55:03.913Z","modified":"2026-06-16T23:57:10.05Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:40.988689Z"}],"osv":[{"id":"CVE-2013-4402","description":"The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.","status":"published","published":"2013-10-28T22:55:03Z","modified":"2026-04-16T06:16:47.675739188Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-4402","description":"The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.","status":"published","published":"2013-10-28T22:55:03.913Z","modified":"2026-09-01T20:03:18.194838353Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"DSA-2773-1","title":"gnupg - several","status":"published","published":"2013-10-10T00:00:00Z","modified":"2026-03-09T01:19:04.413743Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"DSA-2774-1","title":"gnupg2 - several","status":"published","published":"2013-10-10T00:00:00Z","modified":"2026-03-09T01:19:29.861719Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"MGASA-2013-0299","title":"Updated gnupg2 packages fix multiple vulnerabilities","description":"Updated gnupg2 package fixes security vulnerabilities:\n\nRFC 4880 permits OpenPGP keyholders to mark their primary keys and subkeys\nwith a \"key flags\" packet that indicates the capabilities of the key. These\nare represented as a set of binary flags, including things like \"This key may\nbe used to encrypt communications.\" If a key or subkey has this \"key flags\"\nsubpacket attached with all bits cleared (off), GnuPG currently treats the key\nas having all bits set (on). While keys with this sort of marker are very rare\nin the wild, GnuPG's misinterpretation of this subpacket could lead to a\nbreach of confidentiality or a mistaken identity verification (CVE-2013-4351).\n\nSpecial crafted input data may be used to cause a denial of service against\nGPG. GPG can be forced to recursively parse certain parts of OpenPGP messages\nad infinitum (CVE-2013-4402).\n","status":"published","published":"2013-10-09T22:34:30Z","modified":"2026-04-16T06:24:28.987675067Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2013-0303","title":"Updated gnupg packages fix CVE-2013-4402","description":"Updated gnupg package fixes security vulnerability:\n\nSpecial crafted input data may be used to cause a denial of service against\nGPG. GPG can be forced to recursively parse certain parts of OpenPGP messages\nad infinitum (CVE-2013-4402).\n","status":"published","published":"2013-10-09T22:47:49Z","modified":"2026-04-16T06:25:00.26648471Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10102-1","title":"gpg2-2.1.16-1.1 on GA media","description":"These are all security issues fixed in the gpg2-2.1.16-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:31:53.99317Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2013:1458","title":"Red Hat Security Advisory: gnupg security update","status":"published","published":"2024-09-15T21:10:32Z","modified":"2026-06-26T10:22:28Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2013:1459","title":"Red Hat Security Advisory: gnupg2 security update","status":"published","published":"2024-09-15T21:10:33Z","modified":"2026-06-26T10:22:29Z","updated_at":"2026-11-02T15:53:01.993625Z"}]}}