Description
gpg-key2ps in signing-party 1.1.x and 2.x before 2.10-1 contains an unsafe shell call enabling shell injection via a User ID.
References (3)
Core 3
Core References
Exploit, Issue Tracking, Mailing List, Third Party Advisory x_refsource_misc
https://bugs.debian.org/928256
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2019/05/msg00001.html
Mailing List, Third Party Advisory vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00029.html
Scores
CVSS v3
9.8
EPSS
0.0047
EPSS Percentile
64.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-78
Status
published
Products (4)
debian/debian_linux
8.0
opensuse/leap
15.0
opensuse/leap
42.3
signing-party_project/signing-party
1.1 - 2.10
Published
Apr 30, 2019
Tracked Since
Feb 18, 2026