CVE-2018-9234 — HIGH (7.5) — White Hats Nepal

Vulnerability Description

GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey.

CVSS Score

7.5

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Gnupg	Gnupg	2.2.4
Canonical	Ubuntu Linux	14.04

Related Weaknesses (CWE)

CWE-320

References

https://dev.gnupg.org/T3844Issue TrackingThird Party Advisory
https://usn.ubuntu.com/3675-1/Third Party Advisory
https://dev.gnupg.org/T3844Issue TrackingThird Party Advisory
https://usn.ubuntu.com/3675-1/Third Party Advisory

FAQ

What is CVE-2018-9234?

CVE-2018-9234 is a vulnerability with a CVSS score of 7.5 (HIGH). GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with acces...

How severe is CVE-2018-9234?

CVE-2018-9234 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-9234?

Check the references section above for vendor advisories and patch information. Affected products include: Gnupg Gnupg, Canonical Ubuntu Linux.