GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker's OpenPGP key, and this key has AEAD preferences. The overflow is caused by a g10/key-check.c error. NOTE: GnuPG 2.3.x is unaffected. GnuPG 2.2.23 is a fixed version.
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
| Link | Tags |
|---|---|
| https://bugzilla.opensuse.org/show_bug.cgi?id=1176034 | issue tracking exploit third party advisory |
| https://dev.gnupg.org/rG8ec9573e57866dda5efb4677d4454161517484bc | patch vendor advisory |
| https://lists.gnupg.org/pipermail/gnupg-announce/2020q3/000448.html | vendor advisory |
| https://dev.gnupg.org/T5050 | mailing list |
| http://www.openwall.com/lists/oss-security/2020/09/03/4 | third party advisory mailing list |
| http://www.openwall.com/lists/oss-security/2020/09/03/5 | third party advisory mailing list |