Vulnerability in Gnu Privacy_guard
CVE-2003-0971
GnuPG (GPG) 1.0.2, and other versions up to 1.2.3, creates ElGamal type 20 (sign+encrypt) keys using the same key component for encryption as for signing, which allows attackers to determine the private key from a signature.
EPSS: 0.029 (84.9th percentile) — read the EPSS interpretation.
Affected products
- Gnu Privacy_guard — versions 1.0.2, 1.0.3, 1.0.3b
- N/a — versions n/a
Public proof-of-concept exploits
References
- cve@mitre.org (x_refsource_REDHAT, vendor-advisory)
- cve@mitre.org (vendor-advisory, x_refsource_SUSE)
- cve@mitre.org (US Government Resource, x_refsource_CERT-VN, third-party-advisory)
- cve@mitre.org (x_refsource_SECUNIA, third-party-advisory)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (vendor-advisory, x_refsource_DEBIAN)
- cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
- cve@mitre.org (Patch, vdb-entry, x_refsource_BID, Vendor Advisory)
- cve@mitre.org (x_refsource_CONFIRM, Patch)
- cve@mitre.org (x_refsource_REDHAT, vendor-advisory)
Frequently asked questions
- What is CVE-2003-0971?
- CVE-2003-0971 is a vulnerability in Gnu Privacy_guard. Published 2003-12-15.
- Is CVE-2003-0971 known to be exploited?
- 22 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.