VDB

GHSA-qh62-ch95-63wh

GHSA-qh62-ch95-63wh PUBLISHED CVSS 7.5 HIGH

python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting the affect functionality component.

Risk Scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Timeline

  • CVE Published
  • Feb 22, 2026 Security Advisory
  • Mar 7, 2026 Distribution Patch
  • Mar 7, 2026 Distribution Patch
  • Mar 7, 2026 Distribution Patch
  • Mar 7, 2026 Security Advisory
  • Mar 7, 2026 Security Advisory
  • Mar 7, 2026 Security Advisory
  • Mar 7, 2026 Security Advisory
  • Mar 21, 2026 Distribution Patch
  • Mar 21, 2026 Distribution Patch
  • Mar 21, 2026 Security Advisory
Open in Interactive Console →
$ Console Community · 50/day Open console ›