Unscored severity · published Feb 12, 2001
CVE-2001-0072
gpg (aka GnuPG) 1.0.4 and other versions imports both public and private keys from public key servers without notifying the user about the private keys, which could allow an…
–
CVSS
2%
EPSS
No
On KEV
Description
gpg (aka GnuPG) 1.0.4 and other versions imports both public and private keys from public key servers without notifying the user about the private keys, which could allow an attacker to break the web of trust.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PG
Privacy Guard · Gnu
1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.3b · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2001-0072
CVE.org
https://www.cve.org/CVERecord?id=CVE-2001-0072
distro.conectiva.com.br
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000368
www.debian.org
http://www.debian.org/security/2000/20001225b
www.linux-mandrake.com
http://www.linux-mandrake.com/en/updates/2000/MDKSA-2000-087.php3
www.osvdb.org
http://www.osvdb.org/1702
www.redhat.com
http://www.redhat.com/support/errata/RHSA-2000-131.html
www.securityfocus.com
http://www.securityfocus.com/archive/1/152197
More from Privacy Guard
–
CVE-2006-6235
A "stack overwrite" vulnerability in GnuPG (gpg) 1.x before 1.4.6, 2.x before 2.0.2, and 1.9.0 through 1.9.95 allows attackers to execute arbitrary code via crafted OpenPGP…
–
CVE-2006-0049
gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, which allows attackers to inject unsigned data via a data packet that is not associated with a…
–
CVE-2006-0455
gpgv in GnuPG before 1.4.2.1, when using unattended signature verification, returns a 0 exit code in certain cases even when the detached signature file does not carry a…
–
CVE-2003-0978
Format string vulnerability in gpgkeys_hkp (experimental HKP interface) for the GnuPG (gpg) client 1.2.3 and earlier, and 1.3.3 and earlier, allows remote attackers or a malicious…
–
CVE-2003-0971
GnuPG (GPG) 1.0.2, and other versions up to 1.2.3, creates ElGamal type 20 (sign+encrypt) keys using the same key component for encryption as for signing, which allows attackers…