vulnwire
10.0crit

CVE-2003-0255

The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the great…

Published 23 y ago · modified 4 mo ago · JSON

CVSS
10.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
6.6%
percentile 94%
Public exploits
0
none known

The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the greatest validity of the most valid user ID, which prevents GnuPG from warning the encrypting user when a user ID does not have a trusted path.

Exploit prediction (EPSS)

6.56% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.010.0AV:N/AC:L/Au:N/C:C/I:C/A:C

References

  • turbolinux.com /security/TLSA-2003-34.txt · vendor-advisory, x_refsource_TURBO, x_transferred
  • redhat.com /support/errata/RHSA-2003-175.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • osvdb.org /4947 · vdb-entry, x_refsource_OSVDB, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A135 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • marc.info /?l=bugtraq&m=105362224514081&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • securityfocus.com /bid/7497 · vdb-entry, x_refsource_BID, x_transferred
  • marc.info /?l=bugtraq&m=105311804129104&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • linuxsecurity.com /advisories/gentoo_advisory-3266.html · x_refsource_MISC, x_transferred
  • mandriva.com /security/advisories?name=MDKSA-2003:061 · vendor-advisory, x_refsource_MANDRAKE, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/11930 · vdb-entry, x_refsource_XF, x_transferred
  • distro.conectiva.com.br /atualizacoes/?id=a&anuncio=000694 · vendor-advisory, x_refsource_CONECTIVA, x_transferred
  • redhat.com /support/errata/RHSA-2003-176.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • linuxsecurity.com /advisories/engarde_advisory-3258.html · vendor-advisory, x_refsource_ENGARDE, x_transferred
  • marc.info /?l=bugtraq&m=105301357425157&w=2 · vendor-advisory, x_refsource_ENGARDE, x_transferred
  • kb.cert.org /vuls/id/397604 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • marc.info /?l=bugtraq&m=105215110111174&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.