CVE-2003-0971

Severity

50%

Complexity

99%

Confidentiality

48%

GnuPG (GPG) 1.0.2, and other versions up to 1.2.3, creates ElGamal type 20 (sign+encrypt) keys using the same key component for encryption as for signing, which allows attackers to determine the private key from a signature.

CVSS 2.0 Base Score 5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N).

Overview

Type

GNU GNU Privacy Guard

First reported 21 years ago

2003-12-15 05:00:00

Last updated 7 years ago

2017-10-11 01:29:00

Affected Software

GNU GNU Privacy Guard 1.0.2

1.0.2

GNU GNU Privacy Guard 1.0.3

1.0.3

GNU GNU Privacy Guard 1.0.4

1.0.4

GNU GNU Privacy Guard 1.0.5

1.0.5

GNU GNU Privacy Guard 1.0.6

1.0.6

GNU GNU Privacy Guard 1.0.7

1.0.7

GNU GNU Privacy Guard 1.2

1.2

GNU GNU Privacy Guard 1.2.1

1.2.1

GNU GNU Privacy Guard 1.2.2

1.2.2

GNU GNU Privacy Guard 1.2.3

1.2.3

References

20040202-01-U

CLA-2003:798

http://lists.gnupg.org/pipermail/gnupg-announce/2003q4/000276.html

Patch, Vendor Advisory

http://lists.gnupg.org/pipermail/gnupg-announce/2003q4/000277.html

Patch

20031127 GnuPG's ElGamal signing keys compromised

10304

10349

10399

10400

DSA-429

VU#940388

US Government Resource

MDKSA-2003:109

SuSE-SA:2003:048

RHSA-2003:390

RHSA-2003:395

9115