CVE-2005-2023
published 2005-06-17CVE-2005-2023: The send_pinentry_environment function in asshelp.c in gpg2 on SUSE Linux 9.3 does not properly handle certain options, which can prevent pinentry from being…
PriorityP426critical10CVSS 2.0
AVNACLAuNCCICAC
EPSS
2.28%
81.1th percentile
The send_pinentry_environment function in asshelp.c in gpg2 on SUSE Linux 9.3 does not properly handle certain options, which can prevent pinentry from being found and causes S/MIME signing to fail.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| crypto-js_project | crypto-js | >= 0 < 4.2.0 | 4.2.0 |
| debian | gnupg2 | < gnupg2 1.9.15-1 (bookworm) | gnupg2 1.9.15-1 (bookworm) |
| entronad | crypto-es | >= 0 < 2.1.0 | 2.1.0 |
| suse | suse_linux | — | — |
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv10.0CRITICAL
vendor_debian10.0CRITICAL
vendor_redhat9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
ghsa·2023-10-25
CVE-2023-46133 [CRITICAL] CWE-327 crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
### Impact
#### Summary
Crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and [at least 1,300,000 times weaker than current industry standard][OWASP PBKDF2 Cheatsheet]. This is because it both (1) defaults to [SHA1][SHA1 wiki], a cryptographic hash algorithm considered insecure [since at least 2005][Cryptanalysis of SHA-1] and (2) defaults to [one single iteration][one iteration src], a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to [preimage][preimage attack] and [collision][collision attack] attacks. Remediation of this issue might be very difficult, as the changes required to f
GHSA
crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
ghsa·2023-10-25
CVE-2023-46233 [CRITICAL] CWE-327 crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
### Impact
#### Summary
Crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and [at least 1,300,000 times weaker than current industry standard][OWASP PBKDF2 Cheatsheet]. This is because it both (1) defaults to [SHA1][SHA1 wiki], a cryptographic hash algorithm considered insecure [since at least 2005][Cryptanalysis of SHA-1] and (2) defaults to [one single iteration][one iteration src], a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to [preimage][preimage attack] and [collision][collision attack] attacks.
Potential Impact:
1. If used to protect passwords, the impact is high.
2. If
GHSA
GHSA-5phw-pq6g-29m4: The send_pinentry_environment function in asshelp
ghsa_unreviewed·2022-05-01
CVE-2005-2023 [HIGH] GHSA-5phw-pq6g-29m4: The send_pinentry_environment function in asshelp
The send_pinentry_environment function in asshelp.c in gpg2 on SUSE Linux 9.3 does not properly handle certain options, which can prevent pinentry from being found and causes S/MIME signing to fail.
OSV
CVE-2005-2023: The send_pinentry_environment function in asshelp
osv·2005-06-17·CVSS 10.0
CVE-2005-2023 [CRITICAL] CVE-2005-2023: The send_pinentry_environment function in asshelp
The send_pinentry_environment function in asshelp.c in gpg2 on SUSE Linux 9.3 does not properly handle certain options, which can prevent pinentry from being found and causes S/MIME signing to fail.
Red Hat
crypto-js: PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
vendor_redhat·2023-10-25·CVSS 9.1
CVE-2023-46233 [CRITICAL] CWE-328 crypto-js: PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
crypto-js: PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 4.2.0 contains a patch for this issue. As a wo
Debian
CVE-2005-2023: gnupg2 - The send_pinentry_environment function in asshelp.c in gpg2 on SUSE Linux 9.3 do...
vendor_debian·2005·CVSS 10.0
CVE-2005-2023 [CRITICAL] CVE-2005-2023: gnupg2 - The send_pinentry_environment function in asshelp.c in gpg2 on SUSE Linux 9.3 do...
The send_pinentry_environment function in asshelp.c in gpg2 on SUSE Linux 9.3 does not properly handle certain options, which can prevent pinentry from being found and causes S/MIME signing to fail.
Scope: local
bookworm: resolved (fixed in 1.9.15-1)
bullseye: resolved (fixed in 1.9.15-1)
forky: resolved (fixed in 1.9.15-1)
sid: resolved (fixed in 1.9.15-1)
trixie: resolved (fixed in 1.9.15-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://lists.gnupg.org/pipermail/gpa-dev/2005-June/002291.htmlhttp://lists.gnupg.org/pipermail/gpa-dev/2005-June/002294.htmlhttp://www.novell.com/linux/security/advisories/2005_16_sr.htmlhttps://lists.gnupg.org/pipermail/gpa-dev/2005-May/002284.htmlhttp://lists.gnupg.org/pipermail/gpa-dev/2005-June/002291.htmlhttp://lists.gnupg.org/pipermail/gpa-dev/2005-June/002294.htmlhttp://www.novell.com/linux/security/advisories/2005_16_sr.htmlhttps://lists.gnupg.org/pipermail/gpa-dev/2005-May/002284.html
2005-06-17
Published