GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.
References
| Link | Resource |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=2127010 | Issue Tracking Third Party Advisory |
| https://dev.gnupg.org/T5993 | Patch |
| https://marc.info/?l=oss-security&m=165696590211434&w=4 | Mailing List Patch |
| https://dev.gnupg.org/D556 | Patch |
| https://access.redhat.com/security/cve/CVE-2022-3219 | Third Party Advisory |
Advertisement
Configurations
Information
Published : 2023-02-23 12:15
Updated : 2023-03-03 07:46
NVD link : CVE-2022-3219
Mitre link : CVE-2022-3219
JSON object : View
CWE
CWE-787
Out-of-bounds Write
Advertisement
Products Affected
gnupg
- gnupg