CVE-2001-0072 Security feature bypass in n/a
GnuPG silently imports private keys from servers, allowing attackers to compromise the web of trust without user notification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2001-0072?
CVE-2001-0072 is a medium-severity vulnerability in n/a, published on 7 May 2001. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
gpg (aka GnuPG) 1.0.4 and other versions imports both public and private keys from public key servers without notifying the user about the private keys, which could allow an attacker to break the web of trust.
Which versions are affected by CVE-2001-0072?
It affects 1 product.
Products include Gnu Privacy Guard.
How do I fix CVE-2001-0072?
No fix has been published for CVE-2001-0072 yet. Limit exposure of the affected software until one is available.
Is CVE-2001-0072 being exploited?
There is no known exploitation of CVE-2001-0072 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-7774-m57j-3qmq.