{"id":"CVE-2025-68972","aliases":["ALPINE-CVE-2025-68972","AZL-73192","AZL-73911","BELL-CVE-2025-68972","DEBIAN-CVE-2025-68972","EUVD-2025-205487","GHSA-w789-3q45-984r","JLSEC-2026-562","RHSA-2026:7458","ROOT-OS-DEBIAN-11-CVE-2025-68972","ROOT-OS-DEBIAN-12-CVE-2025-68972","ROOT-OS-DEBIAN-13-CVE-2025-68972","ROOT-OS-UBUNTU-2204-CVE-2025-68972","ROOT-OS-UBUNTU-2404-CVE-2025-68972","UBUNTU-CVE-2025-68972"],"status":"published","title":"In GnuPG through 2.4.8, if a signed message has \\f at the end of a plaintext line, an adversary...","description":"In GnuPG through 2.4.8, if a signed message has \\f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an \"invalid armor\" message is printed during verification). This is related to use of \\f as a marker to denote truncation of a long plaintext line.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00113,"percentile":0.01452,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2025-12-27T22:52:30Z","modified":"2026-10-14T10:00:15Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"gnupg","fixed_in":["2.4.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"gnupg","fixed_in":["2.4.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"gnupg","fixed_in":["2.4.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"gnupg","fixed_in":["2.4.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"gnupg","fixed_in":["2.4.9-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"gnupg2","fixed_in":["2.4.9-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"gnupg","fixed_in":["2.4.9-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"gnupg","fixed_in":["2.4.9-r0"],"sources":["osv"]},{"ecosystem":"Julia","package":"GnuPG_jll","fixed_in":["2.5.16+0"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2","fixed_in":["0:2.4.9-5.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-dirmngr","fixed_in":["0:2.4.9-5.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-g13","fixed_in":["0:2.4.9-5.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-gpg-agent","fixed_in":["0:2.4.9-5.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-gpgconf","fixed_in":["0:2.4.9-5.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-keyboxd","fixed_in":["0:2.4.9-5.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-scdaemon","fixed_in":["0:2.4.9-5.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-smime","fixed_in":["0:2.4.9-5.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-utils","fixed_in":["0:2.4.9-5.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-verify","fixed_in":["0:2.4.9-5.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-wks","fixed_in":["0:2.4.9-5.1.hum1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"gnupg2","fixed_in":["2.2.27-2+deb11u3.aikido.4","2.2.27-2+deb11u3.aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-gnupg2","fixed_in":["2.2.27-2+deb11u3.aikido.4","2.2.27-2+deb11u3.aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"gnupg2","fixed_in":["2.4.7-21+deb13u1.root.io.1","2.4.7-21+deb13u1.root.io.2","2.4.7-21+deb13u1.root.io.3","2.4.7-21+deb13u1.aikido.5","2.4.7-21+deb13u1.root.io.4","2.4.7-21+deb13u1.aikido.6","2.4.7-21+deb13u1.aikido.7","2.4.7-21+deb13u1.aikido.8","2.4.7-21+deb13u1.aikido.9","2.4.7-21+deb13u1.aikido.10","2.4.7-21+deb13u1.aikido.11"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-gnupg2","fixed_in":["2.4.7-21+deb13u1.root.io.1","2.4.7-21+deb13u1.root.io.2","2.4.7-21+deb13u1.root.io.3","2.4.7-21+deb13u1.aikido.5","2.4.7-21+deb13u1.root.io.4","2.4.7-21+deb13u1.aikido.6","2.4.7-21+deb13u1.aikido.7","2.4.7-21+deb13u1.aikido.8","2.4.7-21+deb13u1.aikido.9","2.4.7-21+deb13u1.aikido.10","2.4.7-21+deb13u1.aikido.11"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:22.04","package":"gnupg2","fixed_in":["2.2.27-3ubuntu2.5.root.io.2","2.2.27-3ubuntu2.5.aikido.4","2.2.27-3ubuntu2.5.aikido.3","2.2.27-3ubuntu2.5.aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:22.04","package":"rootio-gnupg2","fixed_in":["2.2.27-3ubuntu2.5.root.io.2","2.2.27-3ubuntu2.5.aikido.4","2.2.27-3ubuntu2.5.aikido.3","2.2.27-3ubuntu2.5.aikido.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.4.0-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.7-r0"},{"fixed":"2.4.9-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0-r1"},{"fixed":"2.4.9-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.40-1.1","2.2.40-1.1+deb12u1","2.2.40-1.1+deb12u2","2.2.40-1.1+hurd.1","2.2.40-1.1+loong64","2.2.40-2","2.2.40-3","2.2.43-1","2.2.43-2","2.2.43-3","2.2.43-4","2.2.43-5","2.2.43-6","2.2.43-7","2.2.43-8","2.2.44-1","2.2.45-1","2.2.45-2","2.2.45-3","2.2.46-1","2.2.46-2","2.2.46-3","2.2.46-4","2.2.46-5","2.2.46-6","2.2.46~pre1-1","2.3.1-1","2.4.3-2","2.4.4-1","2.4.4-2","2.4.4-3","2.4.4-4","2.4.5-1","2.4.5-2","2.4.5-3","2.4.6-1","2.4.7-1","2.4.7-10","2.4.7-11","2.4.7-12","2.4.7-13","2.4.7-14","2.4.7-15","2.4.7-16","2.4.7-17","2.4.7-18","2.4.7-19","2.4.7-2","2.4.7-20","2.4.7-21","2.4.7-3","2.4.7-4","2.4.7-5","2.4.7-6","2.4.7-7","2.4.7-8","2.4.7-9","2.4.8-1","2.4.8-2","2.4.8-3","2.4.8-4","2.4.8-5","2.4.8-6","2.4.9-1","2.4.9-2","2.4.9-3","2.4.9-4","2.4.9-5","2.4.9-6","2.4.9-7","2.4.9-8"]},{"source":"osv","ecosystem":"Debian:13","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-21","2.4.7-21+deb13u1","2.4.8-1","2.4.8-2","2.4.8-3","2.4.8-4","2.4.8-5","2.4.8-6","2.4.9-1","2.4.9-2","2.4.9-3","2.4.9-4","2.4.9-5","2.4.9-6","2.4.9-7","2.4.9-8"]},{"source":"osv","ecosystem":"Debian:14","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-21","2.4.8-1","2.4.8-2","2.4.8-3","2.4.8-4","2.4.8-5","2.4.8-6","2.4.9-1","2.4.9-2","2.4.9-3","2.4.9-4","2.4.9-5","2.4.9-6","2.4.9-7","2.4.9-8"]},{"source":"osv","ecosystem":"Julia","package":"GnuPG_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.5.16+0"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-5.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-dirmngr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-5.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-g13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-5.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-gpg-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-5.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-gpgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-5.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-keyboxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-5.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-scdaemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-5.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-smime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-5.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-5.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-verify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-5.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-wks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-5.1.hum1"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.27-2+deb11u3.aikido.4"},{"fixed":"2.2.27-2+deb11u3.aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.27-2+deb11u3.aikido.4"},{"fixed":"2.2.27-2+deb11u3.aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-21+deb13u1.root.io.1"},{"fixed":"2.4.7-21+deb13u1.root.io.2"},{"fixed":"2.4.7-21+deb13u1.root.io.3"},{"fixed":"2.4.7-21+deb13u1.aikido.5"},{"fixed":"2.4.7-21+deb13u1.root.io.4"},{"fixed":"2.4.7-21+deb13u1.aikido.6"},{"fixed":"2.4.7-21+deb13u1.aikido.7"},{"fixed":"2.4.7-21+deb13u1.aikido.8"},{"fixed":"2.4.7-21+deb13u1.aikido.9"},{"fixed":"2.4.7-21+deb13u1.aikido.10"},{"fixed":"2.4.7-21+deb13u1.aikido.11"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-21+deb13u1.root.io.1"},{"fixed":"2.4.7-21+deb13u1.root.io.2"},{"fixed":"2.4.7-21+deb13u1.root.io.3"},{"fixed":"2.4.7-21+deb13u1.aikido.5"},{"fixed":"2.4.7-21+deb13u1.root.io.4"},{"fixed":"2.4.7-21+deb13u1.aikido.6"},{"fixed":"2.4.7-21+deb13u1.aikido.7"},{"fixed":"2.4.7-21+deb13u1.aikido.8"},{"fixed":"2.4.7-21+deb13u1.aikido.9"},{"fixed":"2.4.7-21+deb13u1.aikido.10"},{"fixed":"2.4.7-21+deb13u1.aikido.11"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:22.04","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.27-3ubuntu2.5.root.io.2"},{"fixed":"2.2.27-3ubuntu2.5.aikido.4"},{"fixed":"2.2.27-3ubuntu2.5.aikido.3"},{"fixed":"2.2.27-3ubuntu2.5.aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:22.04","package":"rootio-gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.27-3ubuntu2.5.root.io.2"},{"fixed":"2.2.27-3ubuntu2.5.aikido.4"},{"fixed":"2.2.27-3ubuntu2.5.aikido.3"},{"fixed":"2.2.27-3ubuntu2.5.aikido.5"}]}]}],"products":[{"vendor":"gnupg","product":"gnupg"}],"references":[{"url":"https://gpg.fail/formfeed","tags":["exploit","Product","web","article","report"]},{"url":"https://news.ycombinator.com/item?id=46404339","tags":["Issue Tracking","report","web","article"]},{"url":"https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i","tags":["Product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68972","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-w789-3q45-984r","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-68972","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-68972","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-68972","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7458","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-68972","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7458.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2425646","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68972","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2025-68972","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-68972","description":"In GnuPG through 2.4.8, if a signed message has \\f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an \"invalid armor\" message is printed during verification). This is related to use of \\f as a marker to denote truncation of a long plaintext line.","status":"published","published":"2025-12-27T22:52:30.957Z","modified":"2026-01-02T20:44:27.393Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:32:36.079745Z"}],"euvd":[{"id":"EUVD-2025-205487","description":"In GnuPG through 2.4.8, if a signed message has \\f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an \"invalid armor\" message is printed during verification). This is related to use of \\f as a marker to denote truncation of a long plaintext line.","status":"published","published":"2025-12-27T22:52:30Z","modified":"2026-01-02T20:44:27Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:56.284833Z"}],"ghsa":[{"id":"GHSA-w789-3q45-984r","title":"In GnuPG through 2.4.8, if a signed message has \\f at the end of a plaintext line, an adversary...","description":"In GnuPG through 2.4.8, if a signed message has \\f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an \"invalid armor\" message is printed during verification). This is related to use of \\f as a marker to denote truncation of a long plaintext line.","status":"published","published":"2025-12-28T00:30:23Z","modified":"2026-01-02T21:31:31Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:05:29.313795Z"}],"nvd":[{"id":"CVE-2025-68972","description":"In GnuPG through 2.4.8, if a signed message has \\f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an \"invalid armor\" message is printed during verification). This is related to use of \\f as a marker to denote truncation of a long plaintext line.","status":"published","published":"2025-12-27T23:15:40.9Z","modified":"2026-10-13T09:10:00.323Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:11:53.683969Z"}],"osv":[{"id":"ALPINE-CVE-2025-68972","description":"In GnuPG through 2.4.8, if a signed message has \\f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an \"invalid armor\" message is printed during verification). This is related to use of \\f as a marker to denote truncation of a long plaintext line.","status":"published","published":"2025-12-27T23:15:40.9Z","modified":"2026-08-27T22:18:03.054163143Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2025-68972","status":"published","published":"2025-12-30T06:07:31.871877Z","modified":"2026-01-26T09:42:22.2165Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:22.77042Z"},{"id":"CVE-2025-68972","description":"In GnuPG through 2.4.8, if a signed message has \\f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an \"invalid armor\" message is printed during verification). This is related to use of \\f as a marker to denote truncation of a long plaintext line.","status":"published","published":"2025-12-27T23:15:40.9Z","modified":"2026-03-14T12:44:38.623793Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:52.859856Z"},{"id":"DEBIAN-CVE-2025-68972","description":"In GnuPG through 2.4.8, if a signed message has \\f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an \"invalid armor\" message is printed during verification). This is related to use of \\f as a marker to denote truncation of a long plaintext line.","status":"published","published":"2025-12-27T23:15:40.9Z","modified":"2026-10-14T10:00:15.72136888Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:48.025964Z"},{"id":"JLSEC-2026-562","title":"In GnuPG through 2.4.8, if a signed message has `\\f` at the end of a plaintext line, an adversary...","description":"In GnuPG through 2.4.8, if a signed message has `\\f` at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an \"invalid armor\" message is printed during verification). This is related to use of `\\f` as a marker to denote truncation of a long plaintext line.","status":"published","published":"2026-05-27T18:18:39.624Z","modified":"2026-07-25T18:24:38.217989713Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"RHSA-2026:7458","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-21T10:09:55Z","modified":"2026-10-06T10:31:09.996864047Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2025-68972","title":"CVE-2025-68972 in gnupg2 - Patched by Root","description":"Root has patched CVE-2025-68972 in the gnupg2 package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-10-07T14:36:47Z","modified":"2026-10-07T15:15:14.366622803Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:29.631993Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2025-68972","title":"CVE-2025-68972 in gnupg2 - Patched by Root","description":"Root has patched CVE-2025-68972 in the gnupg2 package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-10-06T08:47:31Z","modified":"2026-10-06T09:15:03.041199659Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:33.153539Z"},{"id":"ROOT-OS-UBUNTU-2204-CVE-2025-68972","title":"CVE-2025-68972 in gnupg2 - Patched by Root","description":"Root has patched CVE-2025-68972 in the gnupg2 package for Root:Ubuntu:22.04. Multiple fixed versions available.","status":"published","published":"2026-10-07T14:41:05Z","modified":"2026-10-07T15:15:15.064071558Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:35.009385Z"},{"id":"ROOT-OS-UBUNTU-2404-CVE-2025-68972","title":"CVE-2025-68972 in gnupg2 - Patched by Root","description":"Root has patched CVE-2025-68972 in the gnupg2 package for Root:Ubuntu:24.04. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-20T09:42:03Z","modified":"2026-09-28T14:00:04.949043591Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:38.418039Z"},{"id":"UBUNTU-CVE-2025-68972","description":"In GnuPG through 2.4.8, if a signed message has \\f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an \"invalid armor\" message is printed during verification). This is related to use of \\f as a marker to denote truncation of a long plaintext line.","status":"withdrawn","published":"2025-12-27T23:15:00Z","modified":"2026-04-02T21:02:39.775105Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:55.926217Z"},{"id":"AZL-73192","title":"CVE-2025-68972 affecting package gnupg2 for versions less than 2.4.9-1","description":"In GnuPG through 2.4.8, if a signed message has \\f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an \"invalid armor\" message is printed during verification). This is related to use of \\f as a marker to denote truncation of a long plaintext line.","status":"published","published":"2025-12-27T23:15:40Z","modified":"2026-04-21T04:53:57.585156Z","updated_at":"2026-11-02T15:28:09.201912Z"},{"id":"AZL-73911","title":"CVE-2025-68972 affecting package gnupg2 2.4.0-3","description":"In GnuPG through 2.4.8, if a signed message has \\f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an \"invalid armor\" message is printed during verification). This is related to use of \\f as a marker to denote truncation of a long plaintext line.","status":"published","published":"2025-12-27T23:15:40Z","modified":"2026-04-21T04:34:02.277312Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2025-68972","title":"CVE-2025-68972 in rootio-gnupg2 - Patched by Root","description":"Root has patched CVE-2025-68972 in the rootio-gnupg2 package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-01-09T12:27:22Z","modified":"2026-08-26T02:10:22.961438954Z","updated_at":"2026-11-02T15:53:31.514195Z"}]}}