{"id":"CVE-2018-12020","aliases":["ALPINE-CVE-2018-12020","BELL-CVE-2018-12020","DEBIAN-CVE-2018-12020","DLA-2862-1","DSA-4222-1","DSA-4223-1","DSA-4224-1","EUVD-2018-4011","GHSA-678p-6r6j-65f9","MGASA-2018-0292","MGASA-2018-0316","MGASA-2018-0321","MGASA-2018-0354","RHSA-2018:2180","RHSA-2018:2181","SUSE-SU-2018:1696-1","SUSE-SU-2018:1698-1","SUSE-SU-2018:1698-2","SUSE-SU-2018:1814-1","SUSE-SU-2018:2243-1","UBUNTU-CVE-2018-12020","USN-3675-1","USN-3675-2","USN-3964-1","USN-4839-1","openSUSE-SU-2024:10736-1","openSUSE-SU-2024:10815-1","openSUSE-SU-2024:11261-1","openSUSE-SU-2024:14158-1","openSUSE-SU-2026:11755-1"],"status":"published","title":"mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and...","description":"mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the \"--status-fd 2\" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.08247,"percentile":0.94939,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-706"],"published":"2018-06-08T00:00:00Z","modified":"2026-10-23T18:02:58Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"gnupg","fixed_in":["2.2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"gnupg","fixed_in":["2.2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"gnupg","fixed_in":["2.2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"gnupg","fixed_in":["2.2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"gnupg","fixed_in":["2.2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"gnupg","fixed_in":["2.2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"gnupg","fixed_in":["2.2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"gnupg","fixed_in":["2.2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"gnupg","fixed_in":["2.2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"gnupg","fixed_in":["2.2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"gnupg","fixed_in":["2.2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"gnupg","fixed_in":["2.2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"gnupg","fixed_in":["2.2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"gnupg","fixed_in":["2.2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"gnupg","fixed_in":["2.2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"gnupg","fixed_in":["2.1.12-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"gnupg","fixed_in":["2.1.15-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"gnupg","fixed_in":["2.2.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"gnupg","fixed_in":["2.2.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"gnupg","fixed_in":["2.2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"gnupg","fixed_in":["2.2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.10","package":"gnupg1","fixed_in":["1.4.22-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"gnupg1","fixed_in":["1.4.22-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"gnupg1","fixed_in":["1.4.22-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"gnupg1","fixed_in":["1.4.22-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"gnupg1","fixed_in":["1.4.22-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"gnupg1","fixed_in":["1.4.22-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"gnupg1","fixed_in":["1.4.22-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"gnupg1","fixed_in":["1.4.22-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"gnupg1","fixed_in":["1.4.22-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gnupg1","fixed_in":["1.4.22-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gnupg1","fixed_in":["1.4.22-5"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"gnupg2","fixed_in":["2.2.8-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gnupg2","fixed_in":["2.2.8-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gnupg2","fixed_in":["2.2.8-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"gnupg2","fixed_in":["2.0.26-6+deb8u2"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"gnupg2","fixed_in":["2.1.18-8~deb9u2"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"gnupg1","fixed_in":["1.4.21-4+deb9u1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"gnupg","fixed_in":["1.4.18-7+deb8u5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"gnupg","fixed_in":["1.4.19-1.4.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"gnupg2","fixed_in":["2.0.27-1.2.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"python-gnupg","fixed_in":["0.3.6-4.1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"gnupg","fixed_in":["1.4.23-1.mga6"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"gnupg2","fixed_in":["2.1.21-3.1.mga6"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"python-gnupg","fixed_in":["0.3.8-2.1.mga6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnupg2","fixed_in":["0:2.0.14-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnupg2-debuginfo","fixed_in":["0:2.0.14-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnupg2-smime","fixed_in":["0:2.0.14-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnupg2","fixed_in":["0:2.0.14-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnupg2-debuginfo","fixed_in":["0:2.0.14-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnupg2-smime","fixed_in":["0:2.0.14-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnupg2","fixed_in":["0:2.0.14-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnupg2-debuginfo","fixed_in":["0:2.0.14-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnupg2-smime","fixed_in":["0:2.0.14-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnupg2","fixed_in":["0:2.0.14-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnupg2-debuginfo","fixed_in":["0:2.0.14-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnupg2-smime","fixed_in":["0:2.0.14-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"gnupg2","fixed_in":["0:2.0.22-5.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"gnupg2-debuginfo","fixed_in":["0:2.0.22-5.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"gnupg2-smime","fixed_in":["0:2.0.22-5.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gnupg2","fixed_in":["0:2.0.22-5.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gnupg2-debuginfo","fixed_in":["0:2.0.22-5.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gnupg2-smime","fixed_in":["0:2.0.22-5.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"gnupg2","fixed_in":["0:2.0.22-5.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"gnupg2-debuginfo","fixed_in":["0:2.0.22-5.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"gnupg2-smime","fixed_in":["0:2.0.22-5.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gnupg2","fixed_in":["0:2.0.22-5.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gnupg2-debuginfo","fixed_in":["0:2.0.22-5.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gnupg2-smime","fixed_in":["0:2.0.22-5.el7_5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"gpg2","fixed_in":["2.0.9-25.33.42.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"gpg2","fixed_in":["2.0.9-25.33.42.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"gpg2","fixed_in":["2.0.9-25.33.42.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"gpg2","fixed_in":["2.0.9-25.33.42.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"gpg2","fixed_in":["2.0.9-25.33.42.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"gpg2","fixed_in":["2.0.24-9.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"gpg2","fixed_in":["2.0.24-9.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"gpg2","fixed_in":["2.0.24-9.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"gpg2","fixed_in":["2.0.24-9.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"gpg2","fixed_in":["2.0.24-9.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"gpg2","fixed_in":["2.0.24-9.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"gpg2","fixed_in":["2.0.24-9.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"gpg2","fixed_in":["2.0.24-9.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"gpg2","fixed_in":["2.0.24-9.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 4","package":"gpg2","fixed_in":["2.0.24-9.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"gpg2","fixed_in":["2.0.24-9.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"gpg2","fixed_in":["2.2.5-4.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"gnupg","fixed_in":["1.4.16-1ubuntu2.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"gnupg2","fixed_in":["2.0.22-3ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-gnupg","fixed_in":["0.3.6-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"gnupg","fixed_in":["1.4.20-1ubuntu3.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"gnupg2","fixed_in":["2.1.11-6ubuntu2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-gnupg","fixed_in":["0.3.8-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"gnupg2","fixed_in":["2.2.4-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"python-gnupg","fixed_in":["0.4.1-1ubuntu1.18.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.15-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.10","package":"gnupg1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.22-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"gnupg1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.22-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"gnupg1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.22-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"gnupg1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.22-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"gnupg1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.22-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"gnupg1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.22-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"gnupg1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.22-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"gnupg1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.22-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gnupg1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.22-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gnupg1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.22-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gnupg1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.22-5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.9-1+deb9u1"}]}],"versions":["0.3.9-1"],"bundled":2},{"source":"osv","ecosystem":"Debian:8","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.26-6+deb8u2"}]}],"versions":["2.0.26-6","2.0.26-6+deb8u1"]},{"source":"osv","ecosystem":"Debian:9","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.18-8~deb9u2"}]}],"versions":["2.1.18-6","2.1.18-7","2.1.18-8~deb9u1"]},{"source":"osv","ecosystem":"Debian:9","package":"gnupg1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.21-4+deb9u1"}]}],"versions":["1.4.21-4"]},{"source":"osv","ecosystem":"Debian:8","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.18-7+deb8u5"}]}],"versions":["1.4.18-7","1.4.18-7+deb8u1","1.4.18-7+deb8u2","1.4.18-7+deb8u3","1.4.18-7+deb8u3~kbsd8u1","1.4.18-7+deb8u4"]},{"source":"osv","ecosystem":"Mageia:5","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.19-1.4.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.27-1.2.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-4.1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.23-1.mga6"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.21-3.1.mga6"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.8-2.1.mga6"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.9.1-1.mga6"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:6","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.9.1-1.mga6"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19-1.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.6-1.4.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"rootcerts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180411.00-1.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.9.1-1.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.9.1-1.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:6","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.9.1-1.1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnupg2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnupg2-smime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnupg2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnupg2-smime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnupg2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnupg2-smime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnupg2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnupg2-smime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.22-5.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gnupg2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.22-5.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gnupg2-smime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.22-5.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.22-5.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gnupg2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.22-5.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gnupg2-smime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.22-5.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.22-5.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gnupg2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.22-5.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gnupg2-smime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.22-5.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.22-5.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gnupg2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.22-5.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gnupg2-smime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.22-5.el7_5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-25.33.42.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-25.33.42.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-25.33.42.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-25.33.42.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-25.33.42.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.24-9.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.24-9.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.24-9.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.24-9.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.24-9.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.24-9.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.24-9.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.24-9.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.24-9.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.24-9.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.24-9.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-3.7.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.16-1ubuntu2.5"}]}],"versions":["1.4.14-1ubuntu2","1.4.15-1.1ubuntu1","1.4.15-1.1ubuntu2","1.4.15-2ubuntu1","1.4.16-1ubuntu1","1.4.16-1ubuntu2","1.4.16-1ubuntu2.1","1.4.16-1ubuntu2.3","1.4.16-1ubuntu2.4"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.22-3ubuntu1.4"}]}],"versions":["2.0.20-1ubuntu3","2.0.22-1ubuntu1","2.0.22-3ubuntu1","2.0.22-3ubuntu1.1","2.0.22-3ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-1ubuntu0.1~esm1"}]}],"versions":["0.3.5-2","0.3.6-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.20-1ubuntu3.2"}]}],"versions":["1.4.18-7ubuntu1","1.4.19-6ubuntu1","1.4.20-1ubuntu1","1.4.20-1ubuntu2","1.4.20-1ubuntu3","1.4.20-1ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.11-6ubuntu2.1"}]}],"versions":["2.0.28-3ubuntu1","2.0.28-3ubuntu2","2.1.11-6ubuntu1","2.1.11-6ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.8-2ubuntu0.1~esm1"}]}],"versions":["0.3.7-2","0.3.8-1","0.3.8-2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.8.2-0ubuntu1","2:1.8.2-4fakesync1","2:1.9.1-1","2:1.9.7-1~ubuntu0.16.04.1","2:1.9.9-0ubuntu0.16.04.1","2:2.0.3-0ubuntu2~16.04.1","2:2.0.6-0ubuntu1~16.04.1","2:2.0.7-0ubuntu1~16.04.1","2:2.0.8-1~ubuntu0.16.04.2","2:2.1.6+ds1-1~ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-1ubuntu1.1"}]}],"versions":["2.1.15-1ubuntu8","2.2.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-1ubuntu1.18.04.1"}]}],"versions":["0.3.9-1","0.4.1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.9.8.3-1","2:1.9.9-1","2:1.9.9-2","2:2.0.3-0ubuntu2~18.04.1","2:2.0.6-0ubuntu1~18.04.1","2:2.0.7-0ubuntu1~18.04.1","2:2.0.8-1~ubuntu0.18.04.2","2:2.1.2-0ubuntu1~18.04.2","2:2.1.6+ds1-1~ubuntu0.18.04.1","2:2.2.4-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gnupg1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.22-1ubuntu1","1.4.22-3ubuntu1","1.4.22-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:2.1.2-0ubuntu1","2:2.1.3+ds1-3","2:2.1.3+ds1-4","2:2.1.5+ds1-1","2:2.1.6+ds1-1","2:2.2.4-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:2.2.4-0.3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.16-1ubuntu2.5"}]}],"versions":["1.4.14-1ubuntu2","1.4.15-1.1ubuntu1","1.4.15-1.1ubuntu2","1.4.15-2ubuntu1","1.4.16-1ubuntu1","1.4.16-1ubuntu2","1.4.16-1ubuntu2.1","1.4.16-1ubuntu2.3","1.4.16-1ubuntu2.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.20-1ubuntu3.2"}]}],"versions":["1.4.18-7ubuntu1","1.4.19-6ubuntu1","1.4.20-1ubuntu1","1.4.20-1ubuntu2","1.4.20-1ubuntu3","1.4.20-1ubuntu3.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-1ubuntu1.1"}]}],"versions":["2.1.15-1ubuntu8","2.2.4-1ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.22-3ubuntu1.4"}]}],"versions":["2.0.20-1ubuntu3","2.0.22-1ubuntu1","2.0.22-3ubuntu1","2.0.22-3ubuntu1.1","2.0.22-3ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.11-6ubuntu2.1"}]}],"versions":["2.0.28-3ubuntu1","2.0.28-3ubuntu2","2.1.11-6ubuntu1","2.1.11-6ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-1ubuntu1.18.04.1"}]}],"versions":["0.3.9-1","0.4.1-1ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-1ubuntu0.1~esm1"}]}],"versions":["0.3.5-2","0.3.6-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.8-2ubuntu0.1~esm1"}]}],"versions":["0.3.7-2","0.3.8-1","0.3.8-2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-1.4"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.27-2.4"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-1.5"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.6-2.1"}]}],"bundled":2}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"gnupg","product":"gnupg"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_eus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"https://usn.ubuntu.com/3675-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2180","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Vendor Advisory","advisory","web","article","report"]},{"url":"http://openwall.com/lists/oss-security/2018/06/08/2","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2018/dsa-4222","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2181","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2018/dsa-4224","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/104450","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","web"]},{"url":"https://www.debian.org/security/2018/dsa-4223","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/3675-3/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1041051","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","web"]},{"url":"https://usn.ubuntu.com/3675-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://dev.gnupg.org/T4012","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"http://www.openwall.com/lists/oss-security/2019/04/30/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://seclists.org/fulldisclosure/2019/Apr/38","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://usn.ubuntu.com/3964-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/RUB-NDS/Johnny-You-Are-Fired","tags":["x_refsource_MISC","x_transferred","Technical Description","Third Party Advisory","advisory"]},{"url":"https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf","tags":["x_refsource_MISC","x_transferred","Technical Description","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/12/msg00027.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12020","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-678p-6r6j-65f9"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-12020","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-12020","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-12020","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0292.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23162","tags":["report"]},{"url":"https://neopg.io/blog/gpg-signature-spoof/","tags":["web","report"]},{"url":"http://openwall.com/lists/oss-security/2018/06/13/10","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2018-0316.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23277","tags":["report"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/52.9.0/releasenotes/","tags":["web"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/52.9.1/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2018-18/","tags":["advisory"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-05/msg00133.html","tags":["web"]},{"url":"https://neopg.io/blog/enigmail-signature-spoof/","tags":["web"]},{"url":"https://sourceforge.net/p/enigmail/forum/announce/thread/b948279f/","tags":["web","report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-06/msg00094.html","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2018-0321.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23303","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2018-0354.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23415","tags":["report"]},{"url":"https://www.enigmail.net/index.php/en/download/changelog","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-08/msg00050.html","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1589620","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2180.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-12020","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-12020","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2181.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181696-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1096745","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12020","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181698-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181698-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181814-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182243-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1094781","tags":["report"]},{"url":"https://bugzilla.suse.com/1097525","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12019","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-12020","tags":["report"]},{"url":"https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=210e402acd3e284b32db1901e43bf1470e659e49","tags":["report"]},{"url":"https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=2326851c60793653069494379b16d84e4c10a0ac","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3675-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3675-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3675-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3964-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4839-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-9234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-6690","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-0455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-3746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-6169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-9234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6690","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-12020","description":"mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the \"--status-fd 2\" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.","status":"published","published":"2018-06-08T21:00:00Z","modified":"2024-08-05T08:24:03.773Z","updated_at":"2026-11-02T14:35:06.679212Z"}],"euvd":[{"id":"EUVD-2018-4011","description":"mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the \"--status-fd 2\" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.","status":"published","published":"2018-06-08T21:00:00Z","modified":"2024-08-05T08:24:03Z","updated_at":"2026-11-03T02:39:53.575925Z"}],"ghsa":[{"id":"GHSA-678p-6r6j-65f9","title":"mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and...","description":"mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the \"--status-fd 2\" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.","status":"published","published":"2022-05-13T01:02:18Z","modified":"2023-02-01T05:02:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-706"],"updated_at":"2026-11-02T14:49:56.179573Z"}],"nvd":[{"id":"CVE-2018-12020","description":"mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the \"--status-fd 2\" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.","status":"published","published":"2018-06-08T21:29:00.237Z","modified":"2026-06-17T01:37:00.507Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-706"],"updated_at":"2026-11-02T14:04:29.837913Z"}],"osv":[{"id":"ALPINE-CVE-2018-12020","description":"mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the \"--status-fd 2\" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.","status":"published","published":"2018-06-08T21:29:00.237Z","modified":"2026-10-23T17:17:55.206694407Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"BELL-CVE-2018-12020","title":"CVE-2018-12020 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:45.178926Z","modified":"2026-01-26T09:47:01.149385Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-12020","description":"mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the \"--status-fd 2\" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.","status":"published","published":"2018-06-08T21:29:00.237Z","modified":"2026-09-12T10:41:32.122713697Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:07.934182Z"},{"id":"DEBIAN-CVE-2018-12020","description":"mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the \"--status-fd 2\" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.","status":"published","published":"2018-06-08T21:29:00.237Z","modified":"2026-10-23T18:02:58.650712092Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"RHSA-2018:2180","title":"Red Hat Security Advisory: gnupg2 security update","status":"published","published":"2024-09-16T01:38:06Z","modified":"2026-06-26T10:38:15Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:2181","title":"Red Hat Security Advisory: gnupg2 security update","status":"published","published":"2024-09-16T01:38:11Z","modified":"2026-06-26T10:38:15Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"UBUNTU-CVE-2018-12020","description":"mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the \"--status-fd 2\" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.","status":"published","published":"2018-06-08T00:00:00Z","modified":"2026-05-20T16:03:22.870621998Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"DLA-2862-1","title":"python-gnupg - security update","status":"published","published":"2021-12-29T00:00:00Z","modified":"2026-03-09T01:20:56.207358Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-4222-1","title":"gnupg2 - security update","status":"published","published":"2018-06-08T00:00:00Z","modified":"2026-03-09T01:21:14.738637Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"DSA-4223-1","title":"gnupg1 - security update","status":"published","published":"2018-06-08T00:00:00Z","modified":"2026-03-09T01:21:01.188459Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"DSA-4224-1","title":"gnupg - security update","status":"published","published":"2018-06-08T00:00:00Z","modified":"2026-03-09T01:18:10.733705Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2018-0292","title":"Updated gnupg gnupg2 packages fix a security vulnerability","description":"Updated gnupg, gnupg2, and python-gnupg packages fix security vulnerability:\n\nMarcus Brinkmann discovered that during decryption or verification, GnuPG did\nnot properly filter out terminal sequences when reporting the original\nfilename. An attacker could use this to specially craft a file that would\ncause an application parsing GnuPG output to incorrectly interpret the status\nof the cryptographic operation reported by GnuPG (CVE-2018-12020).\n","status":"published","published":"2018-06-19T23:42:28Z","modified":"2026-04-16T06:26:30.005065735Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"MGASA-2018-0316","title":"Updated thunderbird packages fix security vulnerabilities","description":"The updated packages fix several bugs and some security issues:\n\nBuffer overflow using computed size of canvas element. (CVE-2018-12359)\n\nUse-after-free when using focus(). (CVE-2018-12360)\n\nS/MIME and PGP decryption oracles can be built with HTML emails.\n(CVE-2018-12372)\n\nS/MIME plaintext can be leaked through HTML reply/forward. (CVE-2018-12373)\n\nInteger overflow in SSSE3 scaler. (CVE-2018-12362)\n\nUse-after-free when appending DOM nodes. (CVE-2018-12363)\n\nCSRF attacks through 307 redirects and NPAPI plugins. (CVE-2018-12364)\n\nCompromised IPC child process can list local filenames. (CVE-2018-12365)\n\nInvalid data handling during QCMS transformations. (CVE-2018-12366)\n\nUsing form to exfiltrate encrypted mail part by pressing enter in form field.\n(CVE-2018-12374)\n\nMemory safety bugs fixed in Firefox 60, Firefox ESR 60.1, Firefox ESR 52.9,\nand Thunderbird 52.9. (CVE-2018-5188)\n\nThe signature verification routine in Enigmail before 2.0.7 interprets user\nids as status/control messages and does not correctly keep track of the\nstatus of multiple signatures, which allows remote attackers to spoof\narbitrary email signatures via public keys containing crafted primary user\nids. (CVE-2018-12019)\n\nmainproc.c in GnuPG before 2.2.8 mishandles the original filename during\ndecryption and verification actions, which allows remote attackers to spoof\nthe output that GnuPG sends on file descriptor 2 to other programs that use\nthe \"--status-fd 2\" option. For example, the OpenPGP data might represent an\noriginal filename that contains line feed characters in conjunction with\nGOODSIG or VALIDSIG status codes. (CVE-2018-12020)\n","status":"published","published":"2018-07-23T22:27:34Z","modified":"2026-04-16T06:24:51.717355204Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"MGASA-2018-0321","title":"Updated thunderbird packages fix security vulnerabilities","description":"The updated packages fix several bugs and some security issues:\n\nBuffer overflow using computed size of canvas element. (CVE-2018-12359)\n\nUse-after-free when using focus(). (CVE-2018-12360)\n\nS/MIME and PGP decryption oracles can be built with HTML emails.\n(CVE-2018-12372)\n\nS/MIME plaintext can be leaked through HTML reply/forward. (CVE-2018-12373)\n\nInteger overflow in SSSE3 scaler. (CVE-2018-12362)\n\nUse-after-free when appending DOM nodes. (CVE-2018-12363)\n\nCSRF attacks through 307 redirects and NPAPI plugins. (CVE-2018-12364)\n\nCompromised IPC child process can list local filenames. (CVE-2018-12365)\n\nInvalid data handling during QCMS transformations. (CVE-2018-12366)\n\nUsing form to exfiltrate encrypted mail part by pressing enter in form field.\n(CVE-2018-12374)\n\nMemory safety bugs fixed in Firefox 60, Firefox ESR 60.1, Firefox ESR 52.9,\nand Thunderbird 52.9. (CVE-2018-5188)\n\nThe signature verification routine in Enigmail before 2.0.7 interprets user\nids as status/control messages and does not correctly keep track of the\nstatus of multiple signatures, which allows remote attackers to spoof\narbitrary email signatures via public keys containing crafted primary user\nids. (CVE-2018-12019)\n\nmainproc.c in GnuPG before 2.2.8 mishandles the original filename during\ndecryption and verification actions, which allows remote attackers to spoof\nthe output that GnuPG sends on file descriptor 2 to other programs that use\nthe \"--status-fd 2\" option. For example, the OpenPGP data might represent an\noriginal filename that contains line feed characters in conjunction with\nGOODSIG or VALIDSIG status codes. (CVE-2018-12020)\n","status":"published","published":"2018-07-23T22:27:34Z","modified":"2026-04-16T06:22:33.864921592Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"MGASA-2018-0354","title":"Updated thunderbird packages fix security vulnerabilities","description":"Updated thunderbird package fixes security vulnerabilities:\n\n* Spoofing of Email signatures II: The signature verification routine in\n  Enigmail interpreted User IDs as status/control messages and did not\n  correctly keep track of the status of multiple signatures. This allowed\n  remote attackers to spoof arbitrary email signatures via public keys\n  containing crafted primary user ids (CVE-2018-12019).\n\n* Spoofing of Email signatures I: GnuPG 2.2.8 fixed a security bug that\n  allows remote attackers to spoof arbitrary email signatures via the\n  embedded \"--filename\" parameter in OpenPGP literal data packets. This\n  release of Enigmail prevents the exploit for all versions of GnuPG,\n  i.e. also if GnuPG is not updated (CVE-2018-12020).\n","status":"published","published":"2018-08-23T23:35:07Z","modified":"2026-04-16T06:24:42.015539921Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:10736-1","title":"enigmail-2.2.4-1.4 on GA media","description":"These are all security issues fixed in the enigmail-2.2.4-1.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:09:52.409086Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10815-1","title":"dirmngr-2.2.27-2.4 on GA media","description":"These are all security issues fixed in the dirmngr-2.2.27-2.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:45:05.784342Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:11261-1","title":"python36-python-gnupg-0.4.7-1.2 on GA media","description":"These are all security issues fixed in the python36-python-gnupg-0.4.7-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:59.785427Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:14158-1","title":"python310-python-gnupg-0.5.2-1.5 on GA media","description":"These are all security issues fixed in the python310-python-gnupg-0.5.2-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-12T00:00:00Z","modified":"2026-02-04T04:31:05.375827Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:11755-1","title":"python313-python-gnupg-0.5.6-2.1 on GA media","description":"These are all security issues fixed in the python313-python-gnupg-0.5.6-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-11T00:00:00Z","modified":"2026-09-12T10:30:05.331957996Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"SUSE-SU-2018:1696-1","title":"Security update for gpg2","description":"This update for gpg2 fixes the following issues:\n\n- CVE-2018-12020: GnuPG mishandled the original filename during decryption and\n  verification actions, which allowed remote attackers to spoof the output that\n  GnuPG sends on file descriptor 2 to other programs that use the '--status-fd 2'\n  option (bsc#1096745)\n","status":"published","published":"2018-06-15T06:23:01Z","modified":"2026-02-04T02:35:53.266796Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:1698-1","title":"Security update for gpg2","description":"This update for gpg2 fixes the following security issue:\n\n- CVE-2018-12020: GnuPG mishandled the original filename during decryption and\n  verification actions, which allowed remote attackers to spoof the output that\n  GnuPG sends on file descriptor 2 to other programs that use the '--status-fd 2'\n  option (bsc#1096745)\n","status":"published","published":"2018-06-15T11:41:32Z","modified":"2026-02-04T04:05:59.246448Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:1698-2","title":"Security update for gpg2","description":"This update for gpg2 fixes the following security issue:\n\n- CVE-2018-12020: GnuPG mishandled the original filename during decryption and\n  verification actions, which allowed remote attackers to spoof the output that\n  GnuPG sends on file descriptor 2 to other programs that use the '--status-fd 2'\n  option (bsc#1096745)\n","status":"published","published":"2018-10-18T12:46:38Z","modified":"2026-02-04T04:34:07.646655Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:1814-1","title":"Security update for gpg2","description":"This update for gpg2 fixes the following security issue:\n\n- CVE-2018-12020: GnuPG mishandled the original filename during decryption and\n  verification actions, which allowed remote attackers to spoof the output that\n  GnuPG sends on file descriptor 2 to other programs that use the '--status-fd 2'\n  option (bsc#1096745).\n","status":"published","published":"2018-06-26T09:41:03Z","modified":"2026-02-04T02:40:32.617418Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:2243-1","title":"Security update for enigmail","description":"This update for enigmail to 2.0.7 fixes the following issues:\n\nThese security issues were fixed:\n\n- CVE-2018-12020: Mitigation against GnuPG signature spoofing:\n  Email signatures could be spoofed via an embedded '--filename'\n  parameter in OpenPGP literal data packets. This update prevents\n  this issue from being exploited if GnuPG was not updated\n  (boo#1096745)\n- CVE-2018-12019: The signature verification routine interpreted\n  User IDs as status/control messages and did not correctly keep\n  track of the status of multiple signatures. This allowed remote\n  attackers to spoof arbitrary email signatures via public keys\n  containing crafted primary user ids (boo#1097525)\n- Disallow plaintext (literal packets) outside of encrpyted packets\n- Replies to a partially encrypted message may have revealed\n  protected information - no longer display PGP/MIME message\n  part followed by unencrypted data (bsc#1094781)\n- Fix signature Spoofing via Inline-PGP in HTML Mails\n\nThese non-security issues were fixed:\n\n- Fix filter actions forgetting selected mail folder names\n- Fix compatibility issue with Thunderbird 60b7\n","status":"published","published":"2018-08-07T16:05:05Z","modified":"2026-02-04T04:35:32.546316Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"USN-3675-1","title":"gnupg, gnupg2 vulnerabilities","description":"Marcus Brinkmann discovered that during decryption or verification,\nGnuPG did not properly filter out terminal sequences when reporting the\noriginal filename. An attacker could use this to specially craft a file\nthat would cause an application parsing GnuPG output to incorrectly\ninterpret the status of the cryptographic operation reported by GnuPG.\n(CVE-2018-12020)\n\nLance Vick discovered that GnuPG did not enforce configurations where\nkey certification required an offline primary Certify key. An attacker\nwith access to a signing subkey could generate certifications that\nappeared to be valid. This issue only affected Ubuntu 18.04 LTS.\n(CVE-2018-9234)\n","status":"published","published":"2018-06-11T21:53:17Z","modified":"2026-04-27T15:33:03.886966346Z","updated_at":"2026-11-02T16:58:13.496563Z"},{"id":"USN-3675-2","title":"gnupg2 vulnerability","description":"USN-3675-1 fixed a vulnerability in GnuPG 2 for Ubuntu 18.04 LTS and\nUbuntu 17.10. This update provides the corresponding update for GnuPG 2\nin Ubuntu 16.04 LTS and Ubuntu 14.04 LTS.\n\nOriginal advisory details:\n\n Marcus Brinkmann discovered that during decryption or verification,\n GnuPG did not properly filter out terminal sequences when reporting the\n original filename. An attacker could use this to specially craft a file\n that would cause an application parsing GnuPG output to incorrectly\n interpret the status of the cryptographic operation reported by GnuPG.\n","status":"published","published":"2018-06-15T00:43:32Z","modified":"2026-04-27T15:20:09.997878Z","updated_at":"2026-11-02T16:58:13.496563Z"},{"id":"USN-3964-1","title":"python-gnupg vulnerabilities","description":"\nMarcus Brinkmann discovered that GnuPG before 2.2.8 improperly handled certain\ncommand line parameters. A remote attacker could use this to spoof the output of\nGnuPG and cause unsigned e-mail to appear signed.\n(CVE-2018-12020)\n\nIt was discovered that python-gnupg incorrectly handled the GPG passphrase. A\nremote attacker could send a specially crafted passphrase that would allow them\nto control the output of encryption and decryption operations.\n(CVE-2019-6690)\n\n","status":"published","published":"2019-05-02T14:47:59Z","modified":"2026-04-27T15:25:40.537863Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-4839-1","title":"python-gnupg vulnerabilities","description":"Marcus Brinkmann discovered that python-gnupg improperly handled certain\ncommand line parameters. A remote attacker could use this to spoof the\noutput of python-gnupg and cause unsigned e-mail to appear signed.\n(CVE-2018-12020)\n\nIt was discovered that python-gnupg incorrectly handled the GPG passphrase.\nA remote attacker could send a specially crafted passphrase that would\nallow them to control the output of encryption and decryption operations.\n(CVE-2019-6690)","status":"published","published":"2021-03-15T22:21:57Z","modified":"2026-06-29T13:48:33.192066051Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}