Is CVE-2019-6690 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-6690 being exploited in the wild.

How severe is CVE-2019-6690?

Low severity, with a CVSS score of 3, published 21 March 2019.

Which products and versions are affected?

python-gnupg (PyPI) ECOSYSTEM:introduced=0,fixed=0.4.4.

Is there a fix for CVE-2019-6690?

Yes. python-gnupg (PyPI): upgrade to 0.4.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-6690 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2019-6690?

Check whether you run python-gnupg (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-6690: Duplicate Advisory: python-gnupg allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended

CVE-2019-6690 · Severity: low · CVSS 3 · Published 2019-03-21

python-gnupg is a Python wrapper for GnuPG used to encrypt and decrypt data. The library fails to validate passphrases for newline characters, allowing an attacker who controls the passphrase to inject arbitrary commands into the encryption/decryption process. This can lead to unauthorized decryption of ciphertexts or modification of plaintext data, potentially compromising the confidentiality and integrity of encrypted communications.

Technologies: python-gnupg (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2019-6690 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-6690 being exploited in the wild.
How severe is CVE-2019-6690?: Low severity, with a CVSS score of 3, published 21 March 2019.
Which products and versions are affected?: python-gnupg (PyPI) ECOSYSTEM:introduced=0,fixed=0.4.4.
Is there a fix for CVE-2019-6690?: Yes. python-gnupg (PyPI): upgrade to 0.4.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-6690 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2019-6690?: Check whether you run python-gnupg (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

python-gnupg (PyPI): upgrade to 0.4.4 or later
```
pip install "python-gnupg>=0.4.4"
```

Technical details

The vulnerability is an improper input validation issue (CWE-20) in python-gnupg versions before 0.4.4, specifically in the encrypt() and decrypt() methods when using symmetric encryption. The root cause is that the library does not sanitize the passphrase parameter for newline characters before passing it to the gpg executable via stdin. The library invokes gpg with --passphrase-fd=0, expecting the passphrase on the first line and ciphertext/plaintext on subsequent lines. An attacker who controls the passphrase can inject newlines to manipulate the data being encrypted or decrypted. The attack requires the passphrase to be under attacker control while the ciphertext/plaintext is trusted; no network access is required. The fix is available in version 0.4.4 and later.

Affected products

python-gnupg python-gnupg 0.2.3 through 0.4.3

Identifiers

CVE-2019-6690
GHSA-2fch-jvg5-crf6
GHSA-qh62-ch95-63wh
PYSEC-2019-115

Timeline

2019-01-19: disclosed: Vulnerability discovered during Insomni'hack teaser CTF
2019-01-22: other: Vendor notified, CVE requested
2019-01-23: other: CVE-2019-6690 assigned; vendor committed fix
2019-01-24: patched: Version 0.4.4 released with fix
2019-03-21: advisory: NVD entry published
2019-03-25: advisory: GitHub Security Advisory (GHSA-2fch-jvg5-crf6) published

References

https://blog.hackeriet.no/cve-2019-6690-python-gnupg-vulnerability

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.