Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
GnuPG签名消息任意内容注入漏洞
Vulnerability Description
GnuPG是基于OpenPGP标准的PGP加密、解密、签名工具。 使用GnuPG的脚本和应用程序向终端用户显示签名验证信息的方式存在漏洞，允许攻击者向签名消息中添加任意内容，消息的接收者无法区分消息中的伪造和正确签名部分。 漏洞起因是有效的OpenPGP消息包含有多个部分，其中每个部分都可以认为是一段消息，但有些消息可能没有被签名和/或加密。有漏洞的第三方应用程序没有使用适当的GnuPG API判断消息边界，没有在给终端用户的输出中明确的区分消息。在某些情况下，即使从命令行直接使用GnuPG的高级用户也可
CVSS Information
N/A
Vulnerability Type
N/A