CVE-2020-25125
Fixed in a distro release EPSS 1%
GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker's OpenPGP key, and this key has AEAD preferences. The overflow is caused by a g10/key-check.c error. NOTE: GnuPG 2.3.x is unaffected. GnuPG 2.2.23 is a fixed version.
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.12 | gnupg | 2.2.23-r0 |
| Alpine 3.13 | gnupg | 2.2.23-r0 |
| Alpine 3.14 | gnupg | 2.2.23-r0 |
| Alpine 3.15 | gnupg | 2.2.23-r0 |
| Alpine 3.16 | gnupg | 2.2.23-r0 |
| Alpine 3.17 | gnupg | 2.2.23-r0 |
| Alpine 3.18 | gnupg | 2.2.23-r0 |
| Alpine 3.19 | gnupg | 2.2.23-r0 |
| Alpine 3.20 | gnupg | 2.2.23-r0 |
| Alpine 3.21 | gnupg | 2.2.23-r0 |
| Alpine 3.22 | gnupg | 2.2.23-r0 |
| Alpine 3.23 | gnupg | 2.2.23-r0 |
| Alpine 3.24 | gnupg | 2.2.23-r0 |
| Arch Linux | gnupg | 2.2.23-1 |
| Chainguard | gnupg | 0 |
| Wolfi | gnupg | 0 |
| openSUSE Tumbleweed | gpg2 | 2.2.27-2.4 |