CVE-2018-12020

Name
CVE-2018-12020
Description
mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Mailing List https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html
Patch https://dev.gnupg.org/T4012
Mailing List http://openwall.com/lists/oss-security/2018/06/08/2
Third Party Advisory https://www.debian.org/security/2018/dsa-4224
Third Party Advisory https://www.debian.org/security/2018/dsa-4223
Third Party Advisory https://www.debian.org/security/2018/dsa-4222
Third Party Advisory http://www.securitytracker.com/id/1041051
Third Party Advisory https://usn.ubuntu.com/3675-1/
Third Party Advisory http://www.securityfocus.com/bid/104450
Third Party Advisory https://usn.ubuntu.com/3675-2/
Third Party Advisory https://usn.ubuntu.com/3675-3/
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:2181
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:2180
Third Party Advisory https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0
Mailing List http://www.openwall.com/lists/oss-security/2019/04/30/4
Mailing List http://seclists.org/fulldisclosure/2019/Apr/38
Third Party Advisory http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html
Third Party Advisory https://usn.ubuntu.com/3964-1/
Technical Description https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf
Technical Description https://github.com/RUB-NDS/Johnny-You-Are-Fired

Match rules

CPE URI Source package Min version Max version
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* enterprise_linux_server_aus == None == 7.6
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:* enterprise_linux_server_eus == None == 7.5
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:* enterprise_linux_server_eus == None == 7.6
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* enterprise_linux_server_tus == None == 7.6
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* enterprise_linux_desktop == None == 6.0
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* enterprise_linux_server == None == 6.0
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* enterprise_linux_workstation == None == 6.0
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* enterprise_linux_server == None == 7.0
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* enterprise_linux_desktop == None == 7.0
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* enterprise_linux_workstation == None == 7.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
gnupg1 edge-community 1.4.22-r1 None fixed
gnupg1 3.12-main 1.4.22-r1 None fixed
gnupg1 3.11-main 1.4.22-r1 None fixed
gnupg1 3.10-main 1.4.22-r1 None fixed
gnupg edge-main 2.2.8-r0 None fixed
gnupg 3.22-main 2.2.8-r0 None fixed
gnupg 3.21-main 2.2.8-r0 None fixed
gnupg 3.20-main 2.2.8-r0 None fixed
gnupg 3.19-main 2.2.8-r0 None fixed
gnupg 3.18-main 2.2.8-r0 None fixed
gnupg 3.17-main 2.2.8-r0 None fixed
gnupg 3.12-main 2.2.8-r0 None fixed
gnupg 3.11-main 2.2.8-r0 None fixed
gnupg 3.10-main 2.2.8-r0 None fixed