{"id":"CVE-2019-6690","aliases":["DEBIAN-CVE-2019-6690","DLA-1675-1","DLA-2862-1","EUVD-2019-0114","GHSA-2fch-jvg5-crf6","GHSA-qh62-ch95-63wh","MGASA-2019-0105","PYSEC-2019-115","UBUNTU-CVE-2019-6690","USN-3964-1","USN-4839-1","openSUSE-SU-2019:0143-1","openSUSE-SU-2019:0239-1","openSUSE-SU-2024:11261-1","openSUSE-SU-2024:14158-1","openSUSE-SU-2026:11755-1"],"status":"published","title":"Improper Input Validation python-gnupg","description":"python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a \"CWE-20: Improper Input Validation\" issue affecting the affect functionality component.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.08617,"percentile":0.95129,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20"],"published":"2019-02-14T00:00:00Z","modified":"2026-09-21T07:02:59Z","exploits":[{"source":"pocgithub","id":"stigtsp/CVE-2019-6690-python-gnupg-vulnerability","title":"stigtsp/CVE-2019-6690-python-gnupg-vulnerability","date":"2019-01-20","url":"https://github.com/stigtsp/CVE-2019-6690-python-gnupg-vulnerability"},{"source":"pocgithub","id":"brianwrf/CVE-2019-6690","title":"brianwrf/CVE-2019-6690","date":"2019-04-03","url":"https://github.com/brianwrf/CVE-2019-6690"}],"fixes":[{"ecosystem":"PyPI","package":"python-gnupg","fixed_in":["0.4.4"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-gnupg","fixed_in":["0.4.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-gnupg","fixed_in":["0.4.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-gnupg","fixed_in":["0.4.4-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"python-gnupg","fixed_in":["0.3.6-1+deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"python-gnupg","fixed_in":["0.4.4-1.mga6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-gnupg","fixed_in":["0.3.6-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-gnupg","fixed_in":["0.3.8-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"python-gnupg","fixed_in":["0.4.1-1ubuntu1.18.04.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15","package":"python-python-gnupg","fixed_in":["0.4.4-bp150.2.3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-1+deb8u1"}]}],"versions":["0.3.6-1"]},{"source":"osv","ecosystem":"Debian:9","package":"python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.9-1+deb9u1"}]}],"versions":["0.3.9-1"],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4"}]}],"versions":["0.2.3","0.2.4","0.2.6","0.2.7","0.2.8","0.2.9","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.3.8","0.3.9","0.4.0","0.4.1","0.4.2","0.4.3"]},{"source":"osv","ecosystem":"Mageia:6","package":"python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4-1.mga6"}]}]},{"source":"osv","ecosystem":"PyPI","package":"python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4"}]}],"versions":["0.2.3","0.2.4","0.2.6","0.2.7","0.2.8","0.2.9","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.3.8","0.3.9","0.4.0","0.4.1","0.4.2","0.4.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-1ubuntu0.1~esm1"}]}],"versions":["0.3.5-2","0.3.6-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.8-2ubuntu0.1~esm1"}]}],"versions":["0.3.7-2","0.3.8-1","0.3.8-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-1ubuntu1.18.04.1"}]}],"versions":["0.3.9-1","0.4.1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.3-1ubuntu1","0.4.5-1","0.4.5-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.6-1","0.4.7-1","0.4.8-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-1ubuntu1.18.04.1"}]}],"versions":["0.3.9-1","0.4.1-1ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-1ubuntu0.1~esm1"}]}],"versions":["0.3.5-2","0.3.6-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.8-2ubuntu0.1~esm1"}]}],"versions":["0.3.7-2","0.3.8-1","0.3.8-2"],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"python-python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4-bp150.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-1.5"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-python-gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.6-2.1"}]}],"bundled":2}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"opensuse","product":"leap"},{"vendor":"python","product":"python-gnupg"},{"vendor":"suse","product":"backports"}],"references":[{"url":"http://www.securityfocus.com/bid/106756","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","web"]},{"url":"http://packetstormsecurity.com/files/151341/Python-GnuPG-0.4.3-Improper-Input-Validation.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://pypi.org/project/python-gnupg/#history","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","package","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00008.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00058.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/02/msg00021.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://seclists.org/bugtraq/2019/Jan/41","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://blog.hackeriet.no/cve-2019-6690-python-gnupg-vulnerability/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","article"]},{"url":"https://usn.ubuntu.com/3964-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6KYZMN2PWXY4ENZVJUVTGFBVYEVY7II/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4VFRUG56542LTYK4444TPJBGR57MT25/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WMV6XNPPL3VB3RQRFFOBCJ3AGWC4K47/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/12/msg00027.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6690","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2fch-jvg5-crf6","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WMV6XNPPL3VB3RQRFFOBCJ3AGWC4K47/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W6KYZMN2PWXY4ENZVJUVTGFBVYEVY7II/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X4VFRUG56542LTYK4444TPJBGR57MT25/","tags":["web"]},{"url":"https://web.archive.org/web/20200227091727/http://www.securityfocus.com/bid/106756","tags":["web"]},{"url":"https://bitbucket.org/vinay.sajip/python-gnupg/commits/1a5196800604c05f9e347110b4ecca538ba68cdc","tags":["web"]},{"url":"https://blog.hackeriet.no/cve-2019-6690-python-gnupg-vulnerability","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qh62-ch95-63wh","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/python-gnupg/PYSEC-2019-115.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WMV6XNPPL3VB3RQRFFOBCJ3AGWC4K47","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W6KYZMN2PWXY4ENZVJUVTGFBVYEVY7II","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X4VFRUG56542LTYK4444TPJBGR57MT25","tags":["web"]},{"url":"https://usn.ubuntu.com/3964-1","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-6690","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0105.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24341","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2019-02/msg00034.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-6690","tags":["report"]},{"url":"https://github.com/stigtsp/CVE-2019-6690-python-gnupg-vulnerability","tags":["report"]},{"url":"https://github.com/vsajip/python-gnupg/commit/39eca266dd837e2ad89c94eb17b7a6f50b25e7cf#diff-88b99bb28683bd5b7e3a204826ead112","tags":["report"]},{"url":"https://github.com/vsajip/python-gnupg/commit/3003b654ca1c29b0510a54b9848571b3ad57df19#diff-88b99bb28683bd5b7e3a204826ead112","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3964-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4839-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-6690","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12020","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/APEB2TMV4R5466CPFHCDNMQ2NAKNEKRW/#APEB2TMV4R5466CPFHCDNMQ2NAKNEKRW","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1123498","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6690","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QAXWGDTCYULVU3YE6PBYHKHJXXNNNWTF/#QAXWGDTCYULVU3YE6PBYHKHJXXNNNWTF","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12020","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-6690","description":"python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a \"CWE-20: Improper Input Validation\" issue affecting the affect functionality component.","status":"published","published":"2019-03-17T17:02:07Z","modified":"2024-08-04T20:31:04.14Z","updated_at":"2026-11-02T14:20:23.381621Z"}],"euvd":[{"id":"EUVD-2019-0114","description":"python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a \"CWE-20: Improper Input Validation\" issue affecting the affect functionality component.","status":"published","published":"2019-03-17T17:02:07Z","modified":"2024-08-04T20:31:04Z","updated_at":"2026-11-03T03:06:48.659106Z"}],"ghsa":[{"id":"GHSA-2fch-jvg5-crf6","title":"Improper Input Validation python-gnupg","description":"python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a \"CWE-20: Improper Input Validation\" issue affecting the affect functionality component.","status":"published","published":"2019-03-25T16:17:53Z","modified":"2023-09-01T20:21:06Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:37:02.095916Z"},{"id":"GHSA-qh62-ch95-63wh","title":"Duplicate Advisory: python-gnupg allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended","description":"**Withdrawn:** Duplicate of GHSA-2fch-jvg5-crf6","status":"withdrawn","published":"2020-03-13T20:05:10Z","modified":"2024-10-25T20:48:46Z","updated_at":"2026-11-02T14:38:13.09489Z"}],"nvd":[{"id":"CVE-2019-6690","description":"python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a \"CWE-20: Improper Input Validation\" issue affecting the affect functionality component.","status":"published","published":"2019-03-21T16:01:09.077Z","modified":"2026-06-17T02:39:31.213Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:05:07.268578Z"}],"osv":[{"id":"CVE-2019-6690","description":"python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a \"CWE-20: Improper Input Validation\" issue affecting the affect functionality component.","status":"published","published":"2019-03-21T16:01:09.077Z","modified":"2026-09-12T10:41:33.363986122Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:12.675558Z"},{"id":"DEBIAN-CVE-2019-6690","description":"python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a \"CWE-20: Improper Input Validation\" issue affecting the affect functionality component.","status":"published","published":"2019-03-21T16:01:09.077Z","modified":"2026-09-21T07:02:59.034104623Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"GHSA-2fch-jvg5-crf6","title":"Improper Input Validation python-gnupg","description":"python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a \"CWE-20: Improper Input Validation\" issue affecting the affect functionality component.","status":"published","published":"2019-03-25T16:17:53Z","modified":"2024-02-22T05:23:39.176453Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:34.338541Z"},{"id":"UBUNTU-CVE-2019-6690","description":"python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a \"CWE-20: Improper Input Validation\" issue affecting the affect functionality component.","status":"published","published":"2019-03-21T00:00:00Z","modified":"2026-02-04T03:55:00.343846Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:21.741399Z"},{"id":"DLA-1675-1","title":"python-gnupg - security update","status":"published","published":"2019-02-14T00:00:00Z","modified":"2026-03-09T01:18:30.732738Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-2862-1","title":"python-gnupg - security update","status":"published","published":"2021-12-29T00:00:00Z","modified":"2026-03-09T01:20:56.207358Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"GHSA-qh62-ch95-63wh","title":"Duplicate Advisory: python-gnupg allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended","description":"**Withdrawn:** Duplicate of GHSA-2fch-jvg5-crf6","status":"withdrawn","published":"2020-03-13T20:05:10Z","modified":"2024-12-05T05:28:07.862403Z","updated_at":"2026-11-02T15:46:54.40888Z"},{"id":"MGASA-2019-0105","title":"Updated python-gnupg packages fix security vulnerability","description":"When symmetric encryption is used, data can be injected through the\npassphrase property of the gnupg.GPG.encrypt() and gnupg.GPG.decrypt()\nmethods. The supplied passphrase is not validated for newlines, and the\nlibrary passes --passphrase-fd=0 to the gpg executable, which expects the\npassphrase on the first line of stdin, and the ciphertext to be decrypted\nor plaintext to be encrypted on subsequent lines. By supplying a passphrase\ncontaining a newline an attacker can control/modify the ciphertext/plaintext\nbeing decrypted/encrypted (CVE-2019-6690).\n","status":"published","published":"2019-03-07T16:34:45Z","modified":"2026-04-16T04:41:46.077457501Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:0143-1","title":"Security update for python-python-gnupg","description":"This update for python-python-gnupg to version 0.4.4 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-6690: Added a check to disallow certain control characters ('\\r', '\\n', NUL) in passphrases (boo#1123498).\n","status":"published","published":"2019-03-23T10:54:32Z","modified":"2026-02-04T04:12:59.001316Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2019:0239-1","title":"Security update for python-python-gnupg","description":"This update for python-python-gnupg to version 0.4.4 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-6690: Added a check to disallow certain control characters ('\\r', '\\n', NUL) in passphrases (boo#1123498).\n\nThis update was imported from the openSUSE:Leap:15.0:Update update project.","status":"published","published":"2019-02-23T15:47:12Z","modified":"2026-02-04T02:48:17.464624Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:11261-1","title":"python36-python-gnupg-0.4.7-1.2 on GA media","description":"These are all security issues fixed in the python36-python-gnupg-0.4.7-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:59.785427Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:14158-1","title":"python310-python-gnupg-0.5.2-1.5 on GA media","description":"These are all security issues fixed in the python310-python-gnupg-0.5.2-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-12T00:00:00Z","modified":"2026-02-04T04:31:05.375827Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:11755-1","title":"python313-python-gnupg-0.5.6-2.1 on GA media","description":"These are all security issues fixed in the python313-python-gnupg-0.5.6-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-11T00:00:00Z","modified":"2026-09-12T10:30:05.331957996Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"PYSEC-2019-115","description":"python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a \"CWE-20: Improper Input Validation\" issue affecting the affect functionality component.","status":"published","published":"2019-03-21T16:01:00Z","modified":"2023-11-08T04:01:37.815771Z","updated_at":"2026-11-02T15:52:52.192131Z"},{"id":"USN-3964-1","title":"python-gnupg vulnerabilities","description":"\nMarcus Brinkmann discovered that GnuPG before 2.2.8 improperly handled certain\ncommand line parameters. A remote attacker could use this to spoof the output of\nGnuPG and cause unsigned e-mail to appear signed.\n(CVE-2018-12020)\n\nIt was discovered that python-gnupg incorrectly handled the GPG passphrase. A\nremote attacker could send a specially crafted passphrase that would allow them\nto control the output of encryption and decryption operations.\n(CVE-2019-6690)\n\n","status":"published","published":"2019-05-02T14:47:59Z","modified":"2026-04-27T15:25:40.537863Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-4839-1","title":"python-gnupg vulnerabilities","description":"Marcus Brinkmann discovered that python-gnupg improperly handled certain\ncommand line parameters. A remote attacker could use this to spoof the\noutput of python-gnupg and cause unsigned e-mail to appear signed.\n(CVE-2018-12020)\n\nIt was discovered that python-gnupg incorrectly handled the GPG passphrase.\nA remote attacker could send a specially crafted passphrase that would\nallow them to control the output of encryption and decryption operations.\n(CVE-2019-6690)","status":"published","published":"2021-03-15T22:21:57Z","modified":"2026-06-29T13:48:33.192066051Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}