-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 CVE-2019-6690: Improper Input Validation in python-gnupg ======================================================== We discovered a way to inject data through the passphrase property of the gnupg.GPG.encrypt() and gnupg.GPG.decrypt() methods when symmetric encryption is used. The supplied passphrase is not validated for newlines, and the library passes --passphrase-fd=0 to the gpg executable, which expects the passphrase on the first line of stdin, and the ciphertext to be decrypted or plaintext to be encrypted on subsequent lines. By supplying a passphrase containing a newline an attacker can control/modify the ciphertext/plaintext being decrypted/encrypted. Vulnerable - ---------- python-gnupg 0.4.3, and maybe earlier versions. Mitigation - ---------- Users should upgrade to 0.4.4. Timeline - -------- 2019-01-19: Vulnerability discovered during Insomni’hack teaser 2019 2019-01-20: PoC created 2019-01-22: Applied for CVE, vendor notified 2019-01-23: CVE-2019-6690 assigned 2019-01-23: Vendor responded, fix committed 2019-01-24: Vendor released 0.4.4 References - ---------- https://pypi.org/project/python-gnupg/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6690 https://blog.hackeriet.no/cve-2019-6690-python-gnupg-vulnerability/ https://github.com/hackeriet/CVE-2019-6690-python-gnupg-vulnerability https://ctftime.org/task/7458 Proof of Concept - ---------------- Hypothetical application using successful decryption of data to authenticate a user, and a way to exploit it is available here: https://blog.hackeriet.no/assets/CVE-2019-6690-python-gnupg-vulnerability.tgz https://blog.hackeriet.no/assets/CVE-2019-6690-python-gnupg-vulnerability.tgz.sig Credits - ------- Vulnerability discovered by Alexander Kjäll and Stig Palmquist. Thanks to @dewaelethom who wrote the CTF challenge. -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEj7OMIAQn+GdSU5z5EMg4owYJR3UFAlxK3b4ACgkQEMg4owYJ R3XWpQ/9Ex7/vIH6k6gFXk2SXTEK19g8D1zsopPsQaE/uzvAARJrdGe0mxAtlqWo Z5C/4w+4B4ioLK8wphFiFglvwNN/qxeTOXR3z5RoVbNSvd4BQ1GQR23N+rqob12P Q4TorKNPjgvlG28aP1O3gywX0vAPtD6N3UITuFgEkUg22jF5vrWns8iX8jPzXfE+ y8FzXnydFXgLJy9+BPIKQ+cNz/jK341WbMav2AUNTWxlbgDymyBNYuWVK7QarFM4 93svE4Pg91EdsLzHctNNwMUg43pQgpnGaw5bUFA4LtNMSElu66Qdr7ZK3ViHrbWB qXEPcbD3el7R4TJxfxVpJtpplMCRF+xDDOBbEVN5i37Ma2WRWVGuhizcZUS7V4Af RvDl38o6aIX3ZHRlxIb2pG0FpQDC4Dzh0GCsEinYZCmvLfAu4OzcD0V+GPLmR21L CzfaGBZJlv5d3poDC/uo5Pi6QOo2I0A6sp3ap76CNpEp/jMzWOkwAvTaYNWnJ51A WzJecxYcf3qXPW+olR8QWqLydz96WEdJFB8xF5gS354eWV3FpYcaedqZVSwJYpGD XLZ0lxEa2PGZvcXJ7XZzs4jNwqaisFELto/GLDVxzRFx1U3oe86rTO4KF+IyYUB7 +bFayUfunzmX3QQYzHVj6KgUh19heb6DpFxDp7kWMKxFPJRr6q8= =7ajV -----END PGP SIGNATURE-----
