CVE-2020-25125 Memory corruption in n/a

High 7.8 Published 3 Sep 2020 Updated 4 Aug 2024

An attacker can cause a crash in GnuPG by tricking a user into importing a malicious OpenPGP key with AEAD preferences.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2020-25125?

CVE-2020-25125 is a high-severity memory corruption vulnerability in n/a, published on 3 Sep 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker's OpenPGP key, and this key has AEAD preferences. The overflow is caused by a g10/key-check.c error. NOTE: GnuPG 2.3.x is unaffected. GnuPG 2.2.23 is a fixed version.

Weakness: CWE-120

Which versions are affected by CVE-2020-25125?

It affects 2 products.

Products include Gnupg Gnupg, Gpg4win Gpg4win.

How do I fix CVE-2020-25125?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2020-25125 being exploited?

There is no known exploitation of CVE-2020-25125 in the wild and no public exploit code.

Sources

Also known as ALPINE-CVE-2020-25125, CLEANSTART-2026-SR17616, GHSA-g8h3-hp92-c5qx.