CVE ID:	CVE-2003-0255
Description:	The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the greatest validity of the most valid user ID, which prevents GnuPG from warning the encrypting user when a user ID does not have a trusted path.
Test IDs:	1.3.6.1.4.1.25623.1.0.50720   1.3.6.1.4.1.25623.1.0.50982
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2003-0255 BugTraq ID: 7497 http://www.securityfocus.com/bid/7497 Bugtraq: 20030504 Key validity bug in GnuPG 1.2.1 and earlier (Google Search) http://marc.info/?l=bugtraq&m=105215110111174&w=2 Bugtraq: 20030516 [OpenPKG-SA-2003.029] OpenPKG Security Advisory (gnupg) (Google Search) http://marc.info/?l=bugtraq&m=105311804129104&w=2 Bugtraq: 20030522 [slackware-security] GnuPG key validation fix (SSA:2003-141-04) (Google Search) http://marc.info/?l=bugtraq&m=105362224514081&w=2 CERT/CC vulnerability note: VU#397604 http://www.kb.cert.org/vuls/id/397604 Conectiva Linux advisory: CLA-2003:694 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000694 En Garde Linux Advisory: 20030515-016 http://www.linuxsecurity.com/advisories/engarde_advisory-3258.html En Garde Linux Advisory: ESA-20030515-016 http://marc.info/?l=bugtraq&m=105301357425157&w=2 http://www.mandriva.com/security/advisories?name=MDKSA-2003:061 http://www.linuxsecurity.com/advisories/gentoo_advisory-3266.html http://www.osvdb.org/4947 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A135 RedHat Security Advisories: RHSA-2003:175 http://www.redhat.com/support/errata/RHSA-2003-175.html RedHat Security Advisories: RHSA-2003:176 http://www.redhat.com/support/errata/RHSA-2003-176.html SCO Security Bulletin: CSSA-2003-034.0 TurboLinux Advisory: TLSA200334 http://www.turbolinux.com/security/TLSA-2003-34.txt XForce ISS Database: gnupg-invalid-key-acceptance(11930) https://exchange.xforce.ibmcloud.com/vulnerabilities/11930