AEAD preference list overflow in 2.2
Closed, ResolvedPublic


Importing a key with AEAD preferences with GnuPG 2.2 can lead to an array overflow. This is not trivial to exploit because the attacker can control only each second byte with the first byte being fixed at 0x04. But it can be exploited.

Affected versions are GnuPG 2.2.21 and 2.2.22. GnuPG 2.3 and versions before 2.2.21 are not affected.

Related Objects

werner created this task.Sep 3 2020, 3:21 PM
werner created this object in space Restricted Space.
werner added a comment.Sep 3 2020, 5:20 PM

The fix will be in the 2.2.23 release (T5045).

werner shifted this object from the Restricted Space space to the S1 Public space.Sep 3 2020, 6:44 PM

2.2.23 has been released and announced.

werner added a comment.Sep 3 2020, 9:56 PM

This has CVE-2020-25125

werner added a comment.Sep 4 2020, 9:06 AM

Small correction: The fixed byte I talked about may have the values 1, 2, 3, or 4.

werner closed this task as Resolved.Sep 4 2020, 5:23 PM

Gpg4win 3.113 has also been released. Thus closing this issue.