Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2006-0455

14 documents8 sources
Severity
4.6MEDIUM
EPSS
1.9%
top 16.82%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
GNU Privacy Guard
Timeline
PublishedFeb 15
Latest updateMay 3

Description

gpgv in GnuPG before 1.4.2.1, when using unattended signature verification, returns a 0 exit code in certain cases even when the detached signature file does not carry a signature, which could cause programs that use gpgv to assume that the signature verification has succeeded. Note: this also occurs when running the equivalent command "gpg --verify".

CVSS vector

AV:L/AC:L/C:P/I:P/A:PExploitability: 3.9 | Impact: 6.4

Affected Packages1 packages

▶NVDgnu/privacy_guard22 versions+21

Patches

Patch: secunia.com ↗Patch: secunia.com ↗Patch: secunia.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-575c-cp7m-ghgh: gpgv in GnuPG before 1↗2022-05-03
▶
CVEList
CVE-2006-0455: gpgv in GnuPG before 1↗2006-02-15
▶

💥Exploits & PoCs

1
Exploit-DB
GnuPG 1.x - Detached Signature Verification Bypass↗2006-02-15
▶

📋Vendor Advisories

4
Red Hat
security flaw↗2006-03-09
▶
Ubuntu
gnupg vulnerability↗2006-02-18
▶
Red Hat
security flaw↗2006-02-15
▶
Debian
CVE-2006-0455: gnupg2 - gpgv in GnuPG before 1.4.2.1, when using unattended signature verification, retu...↗2006
▶

💬Community

6
Bugzilla
CVE-2006-0455 security flaw↗2018-08-16
▶
Bugzilla
CVE-2006-0049 security flaw↗2018-08-16
▶
Bugzilla
CVE-2006-0049, CVE-2006-0455 GnuPG signature verification bugs↗2006-03-13
▶
Bugzilla
CVE-2006-0455 gpg will quietly exit when attempting to verify a malformed message↗2006-03-03
▶
Bugzilla
CVE-2006-0455 gpg will quietly exit when attempting to verify a malformed message↗2006-03-01
▶
CVE-2006-0455 (MEDIUM CVSS 4.6) | gpgv in GnuPG before 1.4.2.1 | cvebase.io