CVE-2019-13050
published 2019-06-29CVE-2019-13050: Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.66%
84.0th percentile
Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| f5 | traffix_signaling_delivery_controller | 5.0.0 – 5.1.0 | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| gnupg | gnupg | <= 2.2.16 | — |
| opensuse | leap | — | — |
| opensuse | leap | — | — |
| sks_keyserver_project | sks_keyserver | <= 1.2.0 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
GnuPG vulnerability
vendor_ubuntu·2022-05-30
CVE-2019-13050 GnuPG vulnerability
Title: GnuPG vulnerability
Summary: GnuPG could be made to stop responding.
It was discovered that GnuPG was not properly processing keys
with large amounts of signatures. An attacker could possibly
use this issue to cause a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
GnuPG: interaction between the sks-keyserver code and GnuPG allows for a Certificate Spamming Attack which leads to persistent DoS
vendor_redhat·2019-06-29·CVSS 7.5
CVE-2019-13050 [HIGH] CWE-297 GnuPG: interaction between the sks-keyserver code and GnuPG allows for a Certificate Spamming Attack which leads to persistent DoS
GnuPG: interaction between the sks-keyserver code and GnuPG allows for a Certificate Spamming Attack which leads to persistent DoS
Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.
Statement: This is a certificate spamming attack, against key servers which use the sks-keyserver software. Attackers were able to poison some certificates in the SKS keyserver network. When GnuPG users import these certificate their installations will break. Currently there is no patch available for GnuPG. Users are encoura
GHSA
GHSA-ch5h-mpfr-fhxh: Interaction between the sks-keyserver code through 1
ghsa_unreviewed·2022-05-24
CVE-2019-13050 [HIGH] CWE-295 GHSA-ch5h-mpfr-fhxh: Interaction between the sks-keyserver code through 1
Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.
OSV
CVE-2019-13050: Interaction between the sks-keyserver code through 1
osv·2019-06-29·CVSS 7.5
CVE-2019-13050 [HIGH] CVE-2019-13050: Interaction between the sks-keyserver code through 1
Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-13050 gnupg: interaction between the sks-keyserver code and GnuPG allows for a Certificate Spamming Attack which leads to persistent DoS [fedora-all]
bugzilla·2019-07-02·CVSS 7.5
CVE-2019-13050 [HIGH] CVE-2019-13050 gnupg: interaction between the sks-keyserver code and GnuPG allows for a Certificate Spamming Attack which leads to persistent DoS [fedora-all]
CVE-2019-13050 gnupg: interaction between the sks-keyserver code and GnuPG allows for a Certificate Spamming Attack which leads to persistent DoS [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and
Bugzilla
CVE-2019-13050 gnupg2: GnuPG: interaction between the sks-keyserver code and GnuPG allows for a Certificate Spamming Attack which leads to persistent DoS [fedora-all]
bugzilla·2019-07-02·CVSS 7.5
CVE-2019-13050 [HIGH] CVE-2019-13050 gnupg2: GnuPG: interaction between the sks-keyserver code and GnuPG allows for a Certificate Spamming Attack which leads to persistent DoS [fedora-all]
CVE-2019-13050 gnupg2: GnuPG: interaction between the sks-keyserver code and GnuPG allows for a Certificate Spamming Attack which leads to persistent DoS [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM chang
Bugzilla
CVE-2019-13050 GnuPG: interaction between the sks-keyserver code and GnuPG allows for a Certificate Spamming Attack which leads to persistent DoS
bugzilla·2019-07-02·CVSS 7.5
CVE-2019-13050 [HIGH] CVE-2019-13050 GnuPG: interaction between the sks-keyserver code and GnuPG allows for a Certificate Spamming Attack which leads to persistent DoS
CVE-2019-13050 GnuPG: interaction between the sks-keyserver code and GnuPG allows for a Certificate Spamming Attack which leads to persistent DoS
Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.
External Reference:
https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f
https://access.redhat.com/articles/4264021
Discussion:
Created gnupg tracking bugs for this issue:
Affects: fedora-all [bug 1726147]
Created gnupg2 tracking bugs for this issue:
Affects: fedora-all [bug 1726148]
---
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00039.htmlhttps://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275fhttps://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3Ehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUK2YRO6QIH64WP2LRA5D4LACTXQPPU4/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CP4ON34YEXEZDZOXXWV43KVGGO6WZLJ5/https://lists.gnupg.org/pipermail/gnupg-announce/2019q3/000439.htmlhttps://support.f5.com/csp/article/K08654551https://support.f5.com/csp/article/K08654551?utm_source=f5support&%3Butm_medium=RSShttps://twitter.com/lambdafu/status/1147162583969009664http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00039.htmlhttps://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275fhttps://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3Ehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUK2YRO6QIH64WP2LRA5D4LACTXQPPU4/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CP4ON34YEXEZDZOXXWV43KVGGO6WZLJ5/https://lists.gnupg.org/pipermail/gnupg-announce/2019q3/000439.htmlhttps://support.f5.com/csp/article/K08654551https://support.f5.com/csp/article/K08654551?utm_source=f5support&%3Butm_medium=RSShttps://twitter.com/lambdafu/status/1147162583969009664
2019-06-29
Published