CVE-2022-34903 GnuPG through 2.3.6 has a vulnerability where an attacker with secret key information from the victim's keyring can forge signatures in unusual situations.

CVE-2022-34903 GnuPG through 2.3.6 has a vulnerability where an attacker with secret key information from the victim's keyring can forge signatures in unusual situations.

This can be exploited after obtaining the sign/encrypt keys and a signed but unencrypted email is received. This issue is closely related to the CVE-2017-5556 issue discussed previously, which involved the same libksba dependency. In the scenario where an attacker has access to the victim's private key and the attacker wants to masquerade as the victim, the attacker can send an email with a signed but unencrypted message. Thus, if the user's public key is available in the keyring, and the user has enabled email signing, GPG will allow the user to decrypt the signed email, with their own private key. This can be exploited after obtaining the sign/encrypt keys and a signed but unencrypted email is received. This issue is closely related to the CVE-2017-5556 issue discussed previously, which involved the same libksba dependency. In the scenario where an attacker has access to the victim's private key and the attacker wants to masquerade as the victim, the attacker can send an email with a signed but unencrypted message. Thus, if the user's public key is available in the keyring, and the user has enabled email signing, GPG will allow the user to decrypt the signed email, with their own private key.

CVE-2017-5556

This vulnerability affects how GPG handles asymmetric keys. If an attacker obtains the victim's private key and the victim has enabled email signing, GPG will create a "signed but unencrypted" message that can be decrypted by the user with their own private key. This issue is closely related to the CVE-2022-34903 issue discussed previously, which involved the same libksba dependency. In the scenario where an attacker has access to the victim's private key and the attacker wants to masquerade as the victim, the attacker can send an email with a signed but unencrypted message. Thus, if the user's public key is available in the keyring, and if email signing was enabled for this public key, GPG will allow users to decrypt emails using their own private keys.

References

Subscribe to CVE.news
Don’t miss out on the latest issues. Sign up now to get access to the library of members-only issues.
jamie@example.com
Subscribe