CVE-2013-4351

CVE Details

Release Date:	2013-03-12
Impact:	None	What is this?

Description

GnuPG 1.4.x, 2.0.x, and 2.1.x treats a key flags subpacket with all bits cleared (no usage permitted) as if it has all bits set (all usage permitted), which might allow remote attackers to bypass intended cryptographic protection mechanisms by leveraging the subkey.

See more information about CVE-2013-4351 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v2 metrics

Base Score:	2.6
Vector String:	AV:N/AC:H/Au:N/C:N/I:P/A:N
Version:	2.0
Attack Vector:	Network
Attack Complexity:	High
Authentication:	None
Confidentiality Impact:	None
Integrity Impact:	Partial
Availability Impact:	None

Errata information

Platform	Errata	Release Date
Oracle Linux version 5 (gnupg)	ELSA-2013-1458	2013-10-24
Oracle Linux version 5 (gnupg2)	ELSA-2013-1459	2013-10-24
Oracle Linux version 6 (gnupg2)	ELSA-2013-1459	2013-10-24