Executive brief
python-gnupg is a Python wrapper for GnuPG used to encrypt and decrypt data. The library fails to validate passphrases for newline characters, allowing an attacker who controls the passphrase to inject arbitrary commands into the encryption/decryption process. This can lead to unauthorized decryption of ciphertexts or modification of plaintext data, potentially compromising the confidentiality and integrity of encrypted communications.
Technical details
The vulnerability is an improper input validation issue (CWE-20) in python-gnupg versions before 0.4.4, specifically in the encrypt() and decrypt() methods when using symmetric encryption. The root cause is that the library does not sanitize the passphrase parameter for newline characters before passing it to the gpg executable via stdin. The library invokes gpg with --passphrase-fd=0, expecting the passphrase on the first line and ciphertext/plaintext on subsequent lines. An attacker who controls the passphrase can inject newlines to manipulate the data being encrypted or decrypted. The attack requires the passphrase to be under attacker control while the ciphertext/plaintext is trusted; no network access is required. The fix is available in version 0.4.4 and later.
Affected products
- python-gnupg python-gnupg 0.2.3 through 0.4.3
Timeline
- 2019-01-19: disclosed: Vulnerability discovered during Insomni'hack teaser CTF
- 2019-01-22: other: Vendor notified, CVE requested
- 2019-01-23: other: CVE-2019-6690 assigned; vendor committed fix
- 2019-01-24: patched: Version 0.4.4 released with fix
- 2019-03-21: advisory: NVD entry published
- 2019-03-25: advisory: GitHub Security Advisory (GHSA-2fch-jvg5-crf6) published