CVE-2019-6690: canonical ubuntu_linux Improper Input Validation
Vulnerability summary
CVE-2019-6690 is a high (CVSS 7.5) Improper Input Validation vulnerability in canonical ubuntu_linux. EPSS estimates a 8.55% chance of exploitation in the next 30 days, higher than 95% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 5 · Related 4Timeline
- 17-03-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting the affect functionality component.
CVSS metrics
5 scores · 4 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
8.55%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
0.00 pp
From 8.55% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- python-gnupg< 0.4.4-1 | < 0.3.6-1+deb8u1
- debian_linuxEOL8.0 | 9.0
Suse2 products
- python-python-gnupg&distro=SUSE Package Hub 15< 0.4.4-bp150.2.3.1
- backportsna
Canonical1 product
- ubuntu_linuxEOL18.04 | 18.10 | 19.04
Mageia1 product
- python-gnupg< 0.4.4-1.mga6
Opensuse1 product
- leapEOL15.0
PyPI1 product
- python-gnupg< 0.4.4
Python1 product
- python-gnupg0.4.3
Ubuntu1 product
- python-gnupg< 0.3.6-1ubuntu0.1~esm1 | < 0.3.8-2ubuntu0.1~esm1 | < 0.4.1-1ubuntu1.18.04.1 | All versions (No fix recorded)
8 vendors · 10 products
References
41 links- packetstormsecurity.com/files/151341/Python-GnuPG-0.4.3-Improper-Input-Validation.htmlX Refsource MISCWEBThird Party AdvisoryVDB Entry
- lists.opensuse.org/opensuse-security-announce/2019-02/msg00008.htmlVendor AdvisoryX Refsource SUSEWEBMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-02/msg00058.htmlVendor AdvisoryX Refsource SUSEWEBMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2019/02/msg00021.htmlMailing ListX Refsource MLISTWEBThird Party Advisory- blog.hackeriet.no/cve-2019-6690-python-gnupg-vulnerability/X Refsource MISCARTICLEThird Party Advisory
Show all 41 references
- lists.debian.org/debian-lts-announce/2021/12/msg00027.htmlMailing ListX Refsource MLISTWEBThird Party Advisory
- lists.opensuse.org/archives/…Advisory
