CVE-2022-34903

MEDIUM

Published Jul 1, 20224y ago · Modified Jun 17, 20262w ago

6.5 CVSS 3.1

Medium

Published Jul 1, 2022 4y ago

Last Modified Jun 17, 2026 2w ago

Description

GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line.

CVSS Details

Base Score

6.5

Exploitability

2.2

Impact

4.2

Vector string

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector Network

Attack Complexity High

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity Low

Availability None

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status

Public Exploit Known

Patch Available

Weaknesses 1

CWE-74

Affected Products 7

Vendor	Product	Version	Range
gnupg	gnupg	*	≤2.3.6
fedoraproject	fedora	35	any
fedoraproject	fedora	36	any
debian	debian_linux	10.0	any
debian	debian_linux	11.0	any
netapp	active_iq_unified_manager	*	any
netapp	ontap_select_deploy_administration_utility	*	any

References 10

openwall.com http://www.openwall.com/lists/oss-security/2022/07/02/1

ExploitMailing ListThird Party Advisory
bugs.debian.org https://bugs.debian.org/1014157

Issue TrackingMailing ListPatchThird Party Advisory
dev.gnupg.org https://dev.gnupg.org/T6027

Issue TrackingPatchVendor Advisory
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRLWJQ76A4UKHI3Q36BKSJKS4LFLQO33/
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPTAR76EIZY7NQFENSOZO7U473257OVZ/
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VN63GBTMRWO36Y7BKA2WQHROAKCXKCBL/
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU64FUVG2PRZBSHFOQRSP7KDVEIZ23OS/
security.netapp.com https://security.netapp.com/advisory/ntap-20220826-0005/

Third Party Advisory
debian.org https://www.debian.org/security/2022/dsa-5174

Third Party Advisory
openwall.com https://www.openwall.com/lists/oss-security/2022/06/30/1

ExploitMailing ListThird Party Advisory

Remediation

bugs.debian.org https://bugs.debian.org/1014157

Issue TrackingMailing ListPatchThird Party Advisory
dev.gnupg.org https://dev.gnupg.org/T6027

Issue TrackingPatchVendor Advisory