PatchTheCVEpython-gnupg vulnerabilities and fixes
Recent CVEs affecting python-gnupg, with upgrade or downgrade steps. 5 tracked.
Also searched as: python gnupg.
python-gnupg has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2019-03-21. Highest priority: CVE-2019-6690 (score 60/100).
- CVE-2019-6690 HIGH 7.5 DOWNGRADE MITIGATE python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended
- CVE-2014-1929 MEDIUM 4.4 DOWNGRADE python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors rela
- CVE-2014-1928 MEDIUM 4.6 UPGRADE The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-depen
- CVE-2014-1927 HIGH 7.5 DOWNGRADE The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent
- CVE-2013-7323 HIGH 7.5 UPGRADE python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metachara
FAQ
How do I fix python-gnupg vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is python-gnupg being exploited right now?
None of the tracked python-gnupg CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which python-gnupg CVE should I patch first?
CVE-2019-6690 currently ranks highest (60/100): python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended.