CVE-2013-4351 Security feature bypass in n/a
Attackers can bypass cryptographic protections by exploiting a flaw where GnuPG incorrectly interprets cleared key flags as fully permitted.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-4351?
CVE-2013-4351 is a medium-severity vulnerability in n/a, published on 10 Oct 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GnuPG 1.4.x, 2.0.x, and 2.1.x treats a key flags subpacket with all bits cleared (no usage permitted) as if it has all bits set (all usage permitted), which might allow remote attackers to bypass intended cryptographic protection mechanisms by leveraging the subkey.
Weakness: CWE-310
Which versions are affected by CVE-2013-4351?
It affects 1 product.
Products include Gnupg Gnupg.
How do I fix CVE-2013-4351?
Upgrade to a fixed version.
Is CVE-2013-4351 being exploited?
There is no known exploitation of CVE-2013-4351 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2013-4351, GHSA-c6gv-ggmm-8j39.