CVE-2018-12020

Vulnerability Description

mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.

CVSS Score

Affected Products

Related Weaknesses (CWE)

References

• http://openwall.com/lists/oss-security/2018/06/08/2Mailing ListThird Party Advisory
• http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.htmlThird Party AdvisoryVDB Entry
• http://seclists.org/fulldisclosure/2019/Apr/38Mailing ListThird Party Advisory
• http://www.openwall.com/lists/oss-security/2019/04/30/4Mailing ListThird Party Advisory
• http://www.securityfocus.com/bid/104450Broken Link
• http://www.securitytracker.com/id/1041051Broken Link
• https://access.redhat.com/errata/RHSA-2018:2180Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:2181Third Party Advisory
• https://dev.gnupg.org/T4012PatchVendor Advisory
• https://github.com/RUB-NDS/Johnny-You-Are-FiredTechnical DescriptionThird Party Advisory
• https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pTechnical DescriptionThird Party Advisory
• https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxurThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/12/msg00027.htmlMailing ListThird Party Advisory
• https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.htmlMailing ListVendor Advisory
• https://usn.ubuntu.com/3675-1/Third Party Advisory