CVE-2013-4351
Fixed in a distro release EPSS 3%
GnuPG 1.4.x, 2.0.x, and 2.1.x treats a key flags subpacket with all bits cleared (no usage permitted) as if it has all bits set (all usage permitted), which might allow remote attackers to bypass intended cryptographic protection mechanisms by leveraging the subkey.
Products: gnupg
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | gnupg2 | 2.0.22-1 |
| Debian 13 | gnupg2 | 2.0.22-1 |
| Debian 14 | gnupg2 | 2.0.22-1 |
| Debian 6.0 | gnupg | 1.4.10-4+squeeze3 |
| Debian 6.0 | gnupg2 | 2.0.14-2+squeeze2 |
| Debian 7 | gnupg | 1.4.12-7+deb7u2 |
| Debian 7 | gnupg2 | 2.0.19-2+deb7u1 |
| Red Hat Enterprise Linux 5 | gnupg | 0:1.4.5-18.el5_10 |
| Red Hat Enterprise Linux 5 | gnupg-debuginfo | 0:1.4.5-18.el5_10 |
| Red Hat Enterprise Linux 5 | gnupg2 | 0:2.0.10-6.el5_10 |
| Red Hat Enterprise Linux 5 | gnupg2-debuginfo | 0:2.0.10-6.el5_10 |
| Red Hat Enterprise Linux 6 | gnupg2 | 0:2.0.14-6.el6_4 |
| Red Hat Enterprise Linux 6 | gnupg2-debuginfo | 0:2.0.14-6.el6_4 |
| Red Hat Enterprise Linux 6 | gnupg2-smime | 0:2.0.14-6.el6_4 |
| openSUSE Tumbleweed | gpg2 | 2.1.16-1.1 |