Test Kennung:	1.3.6.1.4.1.25623.1.1.10.2019.0105
Kategorie:	Mageia Linux Local Security Checks
Titel:	Mageia: Security Advisory (MGASA-2019-0105)
Zusammenfassung:	The remote host is missing an update for the 'python-gnupg' package(s) announced via the MGASA-2019-0105 advisory.
Beschreibung:	Summary: The remote host is missing an update for the 'python-gnupg' package(s) announced via the MGASA-2019-0105 advisory. Vulnerability Insight: When symmetric encryption is used, data can be injected through the passphrase property of the gnupg.GPG.encrypt() and gnupg.GPG.decrypt() methods. The supplied passphrase is not validated for newlines, and the library passes --passphrase-fd=0 to the gpg executable, which expects the passphrase on the first line of stdin, and the ciphertext to be decrypted or plaintext to be encrypted on subsequent lines. By supplying a passphrase containing a newline an attacker can control/modify the ciphertext/plaintext being decrypted/encrypted (CVE-2019-6690). Affected Software/OS: 'python-gnupg' package(s) on Mageia 6. Solution: Please install the updated package(s). CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2019-6690 BugTraq ID: 106756 http://www.securityfocus.com/bid/106756 Bugtraq: 20190125 CVE-2019-6690: Improper Input Validation in python-gnupg (Google Search) https://seclists.org/bugtraq/2019/Jan/41 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W6KYZMN2PWXY4ENZVJUVTGFBVYEVY7II/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X4VFRUG56542LTYK4444TPJBGR57MT25/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WMV6XNPPL3VB3RQRFFOBCJ3AGWC4K47/ http://packetstormsecurity.com/files/151341/Python-GnuPG-0.4.3-Improper-Input-Validation.html https://blog.hackeriet.no/cve-2019-6690-python-gnupg-vulnerability/ https://pypi.org/project/python-gnupg/#history https://lists.debian.org/debian-lts-announce/2019/02/msg00021.html https://lists.debian.org/debian-lts-announce/2021/12/msg00027.html SuSE Security Announcement: SU-2019:0143-1 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00008.html SuSE Security Announcement: SUSE-SU-2019:0239-1 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00058.html https://usn.ubuntu.com/3964-1/
Copyright	Copyright (C) 2022 Greenbone AG

Dies ist nur einer von 145615 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.