CVE-2019-13050 Denial of service in n/a
Retrieving data from SKS keyserver network causes persistent denial of service via certificate spamming, requiring users to avoid SKS hosts in GnuPG config.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-13050?
CVE-2019-13050 is a high-severity denial of service vulnerability in Fedoraproject Fedora, published on 29 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.
Weakness: CWE-295
Which versions are affected by CVE-2019-13050?
It affects 5 products.
Linux distribution packages (7)
gpg2 SUSE:Linux Enterprise Desktop 12 SP4 | All versions | 2.0.24-9.8.1 |
gpg2 SUSE:Linux Enterprise Module for Basesystem 15 | All versions | 2.2.5-4.11.1 |
gpg2 SUSE:Linux Enterprise Module for Basesystem 15 SP1 | All versions | 2.2.5-4.11.1 |
gpg2 SUSE:Linux Enterprise Server 12 SP4 | All versions | 2.0.24-9.8.1 |
gpg2 SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 2.0.24-9.8.1 |
gpg2 openSUSE:Leap 15.0 | All versions | 2.2.5-lp151.6.3.1 |
gpg2 openSUSE:Leap 15.1 | All versions | 2.2.5-lp151.6.3.1 |
Products include F5 Traffix Signaling Delivery Controller, Fedoraproject Fedora, Gnupg Gnupg, Opensuse Leap, Sks Keyserver Project Sks Keyserver.
How do I fix CVE-2019-13050?
Change a configuration setting.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-13050 being exploited?
There is no known exploitation of CVE-2019-13050 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as GHSA-ch5h-mpfr-fhxh, SUSE-SU-2019:2006-1, SUSE-SU-2019:2480-1, UBUNTU-CVE-2019-13050, USN-5431-1, openSUSE-SU-2019:1917-1.