CVE-2022-3219

Publication date 23 February 2023

Last updated 4 October 2024

Ubuntu priority

Low

Why this priority?

Cvss 3 Severity Score

3.3 · Low

Score breakdown

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.

Read the notes from the security team

Status

Package Ubuntu Release Status
gnupg 22.04 LTS jammy Not in release
20.04 LTS focal Not in release
18.04 LTS bionic Not in release
16.04 LTS xenial
Vulnerable, fix deferred
14.04 LTS trusty Ignored end of ESM support, was deferred
gnupg2 24.10 oracular
Vulnerable, fix deferred
24.04 LTS noble
Vulnerable, fix deferred
23.10 mantic Ignored end of life, was deferred [2022-09-28]
23.04 lunar Ignored end of life, was deferred [2022-09-28]
22.10 kinetic Ignored end of life, was deferred [2022-09-28]
22.04 LTS jammy
Vulnerable, fix deferred
20.04 LTS focal
Vulnerable, fix deferred
18.04 LTS bionic
Vulnerable, fix deferred
16.04 LTS xenial
Vulnerable, fix deferred
14.04 LTS trusty Ignored end of standard support

Notes

mdeslaur

per the upstream gnupg bug, the change will not be applied as of 2024-10-04, proposed patch has not been accepted by upstream developers

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
gnupg2

Severity score breakdown

Parameter Value
Base score 3.3 · Low
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality None
Integrity impact None
Availability impact Low
Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L