CVE-2003-0255

Description

The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the greatest validity of the most valid user ID, which prevents GnuPG from warning the encrypting user when a user ID does not have a trusted path.

10.0

CVSS

Severity: Critical

CVSS 2.0 •

EPSS 4.21% Top 15%

Vendor Advisory turbolinux.com Vendor Advisory redhat.com Vendor Advisory mandriva.com Vendor Advisory com.br Vendor Advisory redhat.com Vendor Advisory linuxsecurity.com Vendor Advisory marc.info

Affected: n/a n/a

References

Link	Tags
http://www.turbolinux.com/security/TLSA-2003-34.txt	vendor advisory
http://www.redhat.com/support/errata/RHSA-2003-175.html	patch vendor advisory
http://www.osvdb.org/4947	vdb entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A135	vdb entry signature
http://marc.info/?l=bugtraq&m=105362224514081&w=2	mailing list
http://www.securityfocus.com/bid/7497	vdb entry
http://marc.info/?l=bugtraq&m=105311804129104&w=2	mailing list
http://www.linuxsecurity.com/advisories/gentoo_advisory-3266.html
http://www.mandriva.com/security/advisories?name=MDKSA-2003:061	vendor advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/11930	vdb entry
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000694	vendor advisory
http://www.redhat.com/support/errata/RHSA-2003-176.html	vendor advisory
http://www.linuxsecurity.com/advisories/engarde_advisory-3258.html	vendor advisory
http://marc.info/?l=bugtraq&m=105301357425157&w=2	vendor advisory
http://www.kb.cert.org/vuls/id/397604	third party advisory us government resource
http://marc.info/?l=bugtraq&m=105215110111174&w=2	mailing list

Frequently Asked Questions

What is the severity of CVE-2003-0255?: CVE-2003-0255 has been scored as a critical severity vulnerability.
How to fix CVE-2003-0255?: To fix CVE-2003-0255, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2003-0255 being actively exploited in the wild?: It is possible that CVE-2003-0255 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~4% probability that this vulnerability will be exploited by malicious actors in the next 30 days.