CVE-2022-3219
Fixed in a distro release EPSS <1%CVSS 3.3
GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.
Products: gnupg
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | gnupg | 0 |
| Chainguard | gnupg-dirmngr | 0 |
| Chainguard | gnupg-doc | 0 |
| Chainguard | gnupg-gpgconf | 0 |
| Chainguard | gnupg-lang | 0 |
| Chainguard | gnupg-scdaemon | 0 |
| Chainguard | gnupg-utils | 0 |
| Chainguard | gnupg-wks-client | 0 |
| Chainguard | gpg | 0 |
| Chainguard | gpg-agent | 0 |
| Chainguard | gpg-wks-server | 0 |
| Chainguard | gpgsm | 0 |
| Chainguard | gpgv | 0 |
| Debian 12 | gnupg2 | no fix |
| Debian 13 | gnupg2 | no fix |
| Debian 14 | gnupg2 | no fix |
| Ubuntu 22.04 LTS | gnupg2 | no fix |
| Ubuntu 24.04 LTS | gnupg2 | no fix |
| Ubuntu 25.10 | gnupg2 | no fix |
| Ubuntu Pro 14.04 LTS | gnupg | no fix |
| Ubuntu Pro 16.04 LTS | gnupg | no fix |
| Ubuntu Pro 16.04 LTS | gnupg2 | no fix |
| Ubuntu Pro 18.04 LTS | gnupg2 | no fix |
| Ubuntu Pro 20.04 LTS | gnupg2 | no fix |
| Wolfi | gnupg | 0 |
| Wolfi | gnupg-dirmngr | 0 |
| Wolfi | gnupg-doc | 0 |
| Wolfi | gnupg-gpgconf | 0 |
| Wolfi | gnupg-lang | 0 |
| Wolfi | gnupg-scdaemon | 0 |
| Wolfi | gnupg-utils | 0 |
| Wolfi | gnupg-wks-client | 0 |
| Wolfi | gpg | 0 |
| Wolfi | gpg-agent | 0 |
| Wolfi | gpg-wks-server | 0 |
| Wolfi | gpgsm | 0 |
| Wolfi | gpgv | 0 |