CVE-2019-13050
Fixed in a distro release EPSS 3%
Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.
Products: gnupg, sks_keyserver_project sks_keyserver, fedoraproject fedora, opensuse leap, f5 traffix_signaling_delivery_controller
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | gnupg2 | 2.2.20-2.el8 |
| AlmaLinux 8 | gnupg2-smime | 2.2.20-2.el8 |
| Red Hat Enterprise Linux 8 | gnupg2 | 0:2.2.20-2.el8 |
| Red Hat Enterprise Linux 8 | gnupg2-debuginfo | 0:2.2.20-2.el8 |
| Red Hat Enterprise Linux 8 | gnupg2-debugsource | 0:2.2.20-2.el8 |
| Red Hat Enterprise Linux 8 | gnupg2-smime | 0:2.2.20-2.el8 |
| Red Hat Enterprise Linux 8 | gnupg2-smime-debuginfo | 0:2.2.20-2.el8 |
| Rocky Linux 8 | gnupg2 | 0:2.2.20-2.el8 |
| SUSE Linux Enterprise Desktop 12 SP4 | gpg2 | 2.0.24-9.8.1 |
| SUSE Linux Enterprise Module for Basesystem 15 | gpg2 | 2.2.5-4.11.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP1 | gpg2 | 2.2.5-4.11.1 |
| SUSE Linux Enterprise Server 12 SP4 | gpg2 | 2.0.24-9.8.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | gpg2 | 2.0.24-9.8.1 |
| Ubuntu 16.04 LTS | sks | no fix |
| Ubuntu 18.04 LTS | gnupg2 | 2.2.4-1ubuntu1.5 |
| Ubuntu 18.04 LTS | sks | no fix |
| Ubuntu 20.04 LTS | sks | no fix |
| Ubuntu Pro 14.04 LTS | gnupg | no fix |
| Ubuntu Pro 16.04 LTS | gnupg | no fix |
| Ubuntu Pro 16.04 LTS | gnupg2 | no fix |
| openSUSE Leap 15.0 | gpg2 | 2.2.5-lp151.6.3.1 |
| openSUSE Leap 15.1 | gpg2 | 2.2.5-lp151.6.3.1 |