CVE-2022-3219

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
3.3 LOW
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
redhatCNA
---
---
CVEADP
---
---
CISA-ADPADP
3.3 LOW
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 1%
VendorProductVersion
gnupggnupg
-
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
gnupg2
bullseye (security)
unimportant
bullseye
unimportant
bookworm
unimportant
trixie
unimportant
sid
unimportant
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
gnupg
jammy
dne
focal
dne
bionic
dne
xenial
deferred
trusty
deferred
gnupg2
noble
deferred
mantic
ignored
lunar
ignored
kinetic
ignored
jammy
deferred
focal
deferred
bionic
deferred
xenial
deferred
trusty
ignored
Common Weakness Enumeration
References
https://access.redhat.com/security/cve/CVE-2022-3219
https://bugzilla.redhat.com/show_bug.cgi?id=2127010
https://dev.gnupg.org/D556
https://dev.gnupg.org/T5993
https://marc.info/?l=oss-security&m=165696590211434&w=4
https://security.netapp.com/advisory/ntap-20230324-0001/
https://access.redhat.com/security/cve/CVE-2022-3219
https://bugzilla.redhat.com/show_bug.cgi?id=2127010
https://dev.gnupg.org/D556
https://dev.gnupg.org/T5993
https://marc.info/?l=oss-security&m=165696590211434&w=4
https://security.netapp.com/advisory/ntap-20230324-0001/