CVE-2019-13050
Summary
| CVE | CVE-2019-13050 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2019-06-29 17:15:00 UTC |
|---|
| Updated | 2023-11-07 03:03:00 UTC |
|---|
| Description | Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| SKS Keyserver Network Under Attack · GitHub |
MISC |
gist.github.com |
Exploit, Issue Tracking, Mitigation, Third Party Advisory |
| [bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8 |
|
lists.apache.org |
|
| Pony Mail! |
MLIST |
lists.apache.org |
Mailing List, Third Party Advisory |
| Pony Mail! |
MLIST |
lists.apache.org |
|
| [security-announce] openSUSE-SU-2019:1917-1: important: Security update |
SUSE |
lists.opensuse.org |
Mailing List, Third Party Advisory |
| [SECURITY] Fedora 29 Update: gnupg2-2.2.17-1.fc29 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| Marcus Brinkmann na Twitterze: "Recent reports on the #OpenPGP #keyserver certificate poisoning attacks have focused on the SKS keyserver implemented in OCaml, which is basically a replicated, censor-resistant, append-only database for unverified key material. But what about #gnupg's role in the attack? /thread" |
MISC |
twitter.com |
Third Party Advisory |
| myF5 |
|
support.f5.com |
|
| support.f5.com/csp/article/K08654551 |
CONFIRM |
support.f5.com |
Third Party Advisory |
| [SECURITY] Fedora 30 Update: gnupg2-2.2.17-1.fc30 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
Mailing List, Third Party Advisory |
| [Announce] GnuPG 2.2.17 released to mitigate attacks on keyservers |
CONFIRM |
lists.gnupg.org |
Third Party Advisory |
| [SECURITY] Fedora 30 Update: gnupg2-2.2.17-1.fc30 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 29 Update: gnupg2-2.2.17-1.fc29 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
Mailing List, Third Party Advisory |
| support.f5.com/csp/article/K08654551 |
CONFIRM |
support.f5.com |
Third Party Advisory |
| Pony Mail! |
MLIST |
lists.apache.org |
|
| [bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8 |
|
lists.apache.org |
|
| [mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar |
|
lists.apache.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 198808 Ubuntu Security Notification for GnuPG Vulnerability (USN-5431-1)
- 296078 Oracle Solaris 11.4 Support Repository Update (SRU) 16.4.0 Missing (CPUOCT2019)
- 770068 Red Hat OpenShift Container Platform 4.6 Security Update (RHSA-2021:0436)
- 940257 AlmaLinux Security Update for gnupg2 (ALSA-2020:4490)
- 960413 Rocky Linux Security Update for gnupg2 (RLSA-2020:4490)
