# CVE-2019-6690: Duplicate Advisory: python-gnupg allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended

Source: https://junglewise.ai/threats/cve-2019-6690-python-gnupg-improper-input-validation-in-passphrase-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-03-21. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2019-6690 · Severity: low · CVSS 3 · Published 2019-03-21

python-gnupg is a Python wrapper for GnuPG used to encrypt and decrypt data. The library fails to validate passphrases for newline characters, allowing an attacker who controls the passphrase to inject arbitrary commands into the encryption/decryption process. This can lead to unauthorized decryption of ciphertexts or modification of plaintext data, potentially compromising the confidentiality and integrity of encrypted communications.

Technologies: [python-gnupg (PyPI)](https://junglewise.ai/threats/technologies/python-gnupg). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2019-6690 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-6690 being exploited in the wild.

**How severe is CVE-2019-6690?** Low severity, with a CVSS score of 3, published 21 March 2019.

**Which products and versions are affected?** python-gnupg (PyPI) ECOSYSTEM:introduced=0,fixed=0.4.4.

**Is there a fix for CVE-2019-6690?** Yes. python-gnupg (PyPI): upgrade to 0.4.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-6690 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2019-6690?** Check whether you run python-gnupg (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- python-gnupg (PyPI): upgrade to 0.4.4 or later

  ```sh
  pip install "python-gnupg>=0.4.4"
  ```


## Technical details

The vulnerability is an improper input validation issue (CWE-20) in python-gnupg versions before 0.4.4, specifically in the encrypt() and decrypt() methods when using symmetric encryption. The root cause is that the library does not sanitize the passphrase parameter for newline characters before passing it to the gpg executable via stdin. The library invokes gpg with --passphrase-fd=0, expecting the passphrase on the first line and ciphertext/plaintext on subsequent lines. An attacker who controls the passphrase can inject newlines to manipulate the data being encrypted or decrypted. The attack requires the passphrase to be under attacker control while the ciphertext/plaintext is trusted; no network access is required. The fix is available in version 0.4.4 and later.

## Affected products

- python-gnupg python-gnupg 0.2.3 through 0.4.3

## Identifiers

- CVE-2019-6690
- GHSA-2fch-jvg5-crf6
- GHSA-qh62-ch95-63wh
- PYSEC-2019-115

## Timeline

- 2019-01-19: disclosed: Vulnerability discovered during Insomni'hack teaser CTF
- 2019-01-22: other: Vendor notified, CVE requested
- 2019-01-23: other: CVE-2019-6690 assigned; vendor committed fix
- 2019-01-24: patched: Version 0.4.4 released with fix
- 2019-03-21: advisory: NVD entry published
- 2019-03-25: advisory: GitHub Security Advisory (GHSA-2fch-jvg5-crf6) published

## References

- [https://blog.hackeriet.no/cve-2019-6690-python-gnupg-vulnerability](https://blog.hackeriet.no/cve-2019-6690-python-gnupg-vulnerability)

## Related threats

- [PYSEC-2019-45 - python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than…](https://junglewise.ai/threats/pysec-2019-45-python-gnupg-0-4-3-allows-context-dependent-attackers-to-b9a2b608)
- [python-gnupg vulnerable to shell injection](https://junglewise.ai/threats/cve-2014-1929-python-gnupg-vulnerable-to-shell-injection)
- [python-gnupg's shell_quote function does not properly quote strings](https://junglewise.ai/threats/cve-2014-1927-python-gnupg-s-shell-quote-function-does-not-properly-quote)
- [python-gnupg shell_quote improper character escaping](https://junglewise.ai/threats/cve-2014-1928-python-gnupg-shell-quote-improper-character-escaping)
- [PYSEC-2014-89 - python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.](https://junglewise.ai/threats/cve-2013-7323-python-gnupg-allows-context-dependent-attackers-to-execute)