CVE-2003-0971
Fixed in a distro release EPSS 4%
GnuPG (GPG) 1.0.2, and other versions up to 1.2.3, creates ElGamal type 20 (sign+encrypt) keys using the same key component for encryption as for signing, which allows attackers to determine the private key from a signature.
Products: gnu privacy_guard
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 3.0 | gnupg | 1.0.6-4woody1 |
| Red Hat Enterprise Linux 3 | gnupg | 0:1.2.1-10 |
| Red Hat Enterprise Linux 3 | gnupg-debuginfo | 0:1.2.1-10 |