CVE-2003-0971 (GCVE-0-2003-0971)
Vulnerability from cvelistv5
Published
2003-12-02 05:00
Modified
2024-08-08 02:12
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
GnuPG (GPG) 1.0.2, and other versions up to 1.2.3, creates ElGamal type 20 (sign+encrypt) keys using the same key component for encryption as for signing, which allows attackers to determine the private key from a signature.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T02:12:35.614Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "RHSA-2003:395",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://www.redhat.com/support/errata/RHSA-2003-395.html"
},
{
"name": "20040202-01-U",
"tags": [
"vendor-advisory",
"x_refsource_SGI",
"x_transferred"
],
"url": "ftp://patches.sgi.com/support/free/security/advisories/20040202-01-U.asc"
},
{
"name": "SuSE-SA:2003:048",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://www.novell.com/linux/security/advisories/2003_048_gpg.html"
},
{
"name": "VU#940388",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/940388"
},
{
"name": "10349",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/10349"
},
{
"name": "20031127 GnuPG\u0027s ElGamal signing keys compromised",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=106995769213221\u0026w=2"
},
{
"name": "DSA-429",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2004/dsa-429"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://lists.gnupg.org/pipermail/gnupg-announce/2003q4/000276.html"
},
{
"name": "9115",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/9115"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://lists.gnupg.org/pipermail/gnupg-announce/2003q4/000277.html"
},
{
"name": "RHSA-2003:390",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://www.redhat.com/support/errata/RHSA-2003-390.html"
},
{
"name": "oval:org.mitre.oval:def:10982",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL",
"x_transferred"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10982"
},
{
"name": "10399",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/10399"
},
{
"name": "10304",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/10304"
},
{
"name": "MDKSA-2003:109",
"tags": [
"vendor-advisory",
"x_refsource_MANDRAKE",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2003:109"
},
{
"name": "CLA-2003:798",
"tags": [
"vendor-advisory",
"x_refsource_CONECTIVA",
"x_transferred"
],
"url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000798"
},
{
"name": "10400",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/10400"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-11-27T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "GnuPG (GPG) 1.0.2, and other versions up to 1.2.3, creates ElGamal type 20 (sign+encrypt) keys using the same key component for encryption as for signing, which allows attackers to determine the private key from a signature."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-10-10T00:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "RHSA-2003:395",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://www.redhat.com/support/errata/RHSA-2003-395.html"
},
{
"name": "20040202-01-U",
"tags": [
"vendor-advisory",
"x_refsource_SGI"
],
"url": "ftp://patches.sgi.com/support/free/security/advisories/20040202-01-U.asc"
},
{
"name": "SuSE-SA:2003:048",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://www.novell.com/linux/security/advisories/2003_048_gpg.html"
},
{
"name": "VU#940388",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/940388"
},
{
"name": "10349",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/10349"
},
{
"name": "20031127 GnuPG\u0027s ElGamal signing keys compromised",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=106995769213221\u0026w=2"
},
{
"name": "DSA-429",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2004/dsa-429"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://lists.gnupg.org/pipermail/gnupg-announce/2003q4/000276.html"
},
{
"name": "9115",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/9115"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://lists.gnupg.org/pipermail/gnupg-announce/2003q4/000277.html"
},
{
"name": "RHSA-2003:390",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://www.redhat.com/support/errata/RHSA-2003-390.html"
},
{
"name": "oval:org.mitre.oval:def:10982",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10982"
},
{
"name": "10399",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/10399"
},
{
"name": "10304",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/10304"
},
{
"name": "MDKSA-2003:109",
"tags": [
"vendor-advisory",
"x_refsource_MANDRAKE"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2003:109"
},
{
"name": "CLA-2003:798",
"tags": [
"vendor-advisory",
"x_refsource_CONECTIVA"
],
"url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000798"
},
{
"name": "10400",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/10400"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-0971",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "GnuPG (GPG) 1.0.2, and other versions up to 1.2.3, creates ElGamal type 20 (sign+encrypt) keys using the same key component for encryption as for signing, which allows attackers to determine the private key from a signature."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "RHSA-2003:395",
"refsource": "REDHAT",
"url": "http://www.redhat.com/support/errata/RHSA-2003-395.html"
},
{
"name": "20040202-01-U",
"refsource": "SGI",
"url": "ftp://patches.sgi.com/support/free/security/advisories/20040202-01-U.asc"
},
{
"name": "SuSE-SA:2003:048",
"refsource": "SUSE",
"url": "http://www.novell.com/linux/security/advisories/2003_048_gpg.html"
},
{
"name": "VU#940388",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/940388"
},
{
"name": "10349",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/10349"
},
{
"name": "20031127 GnuPG\u0027s ElGamal signing keys compromised",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=106995769213221\u0026w=2"
},
{
"name": "DSA-429",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2004/dsa-429"
},
{
"name": "http://lists.gnupg.org/pipermail/gnupg-announce/2003q4/000276.html",
"refsource": "CONFIRM",
"url": "http://lists.gnupg.org/pipermail/gnupg-announce/2003q4/000276.html"
},
{
"name": "9115",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/9115"
},
{
"name": "http://lists.gnupg.org/pipermail/gnupg-announce/2003q4/000277.html",
"refsource": "CONFIRM",
"url": "http://lists.gnupg.org/pipermail/gnupg-announce/2003q4/000277.html"
},
{
"name": "RHSA-2003:390",
"refsource": "REDHAT",
"url": "http://www.redhat.com/support/errata/RHSA-2003-390.html"
},
{
"name": "oval:org.mitre.oval:def:10982",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10982"
},
{
"name": "10399",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/10399"
},
{
"name": "10304",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/10304"
},
{
"name": "MDKSA-2003:109",
"refsource": "MANDRAKE",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2003:109"
},
{
"name": "CLA-2003:798",
"refsource": "CONECTIVA",
"url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000798"
},
{
"name": "10400",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/10400"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-0971",
"datePublished": "2003-12-02T05:00:00",
"dateReserved": "2003-12-01T00:00:00",
"dateUpdated": "2024-08-08T02:12:35.614Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2003-0971\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2003-12-15T05:00:00.000\",\"lastModified\":\"2025-04-03T01:03:51.193\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"GnuPG (GPG) 1.0.2, and other versions up to 1.2.3, creates ElGamal type 20 (sign+encrypt) keys using the same key component for encryption as for signing, which allows attackers to determine the private key from a signature.\"},{\"lang\":\"es\",\"value\":\"GnuPG (GPG) 1.0.2 y otras versiones anteriores a 1.2.3 crea claves firma+cifra ElGamal usando el mismo componente para cifrado y para firma, lo que permite a atacantes determinar la clave privada a partir de una firma.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:privacy_guard:1.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DF7811A-B254-4829-AED2-C70BD5C82592\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:privacy_guard:1.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"72ED862B-6278-41ED-9619-115E6552AFBB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:privacy_guard:1.0.3b:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1869E888-E83C-4A62-AA84-F2C9F2AF12FB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:privacy_guard:1.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3D51820-D735-44FC-95BB-A473FFDE9D35\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:privacy_guard:1.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B5FB2C28-0E4D-4AE3-A2CC-0197FE578074\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:privacy_guard:1.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3F2224AF-EA7B-4A3D-8B23-7FC59D66E611\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:privacy_guard:1.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0A2B3B44-941E-4007-B58A-16E85B87CB33\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:privacy_guard:1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"49A642D7-007E-479D-963E-A74AAE195A54\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:privacy_guard:1.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"86144B81-D321-4ECA-937F-FFA8A043FCE4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:privacy_guard:1.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A93CAE1-0DFC-43E1-997D-22CDC338D3E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:privacy_guard:1.2.2:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"9896332E-819B-4392-B704-B143DBBE90A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:privacy_guard:1.2.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4B641ED5-4326-43E7-BF42-982B44478A05\"}]}]}],\"references\":[{\"url\":\"ftp://patches.sgi.com/support/free/security/advisories/20040202-01-U.asc\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000798\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.gnupg.org/pipermail/gnupg-announce/2003q4/000276.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://lists.gnupg.org/pipermail/gnupg-announce/2003q4/000277.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\"]},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=106995769213221\u0026w=2\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/10304\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/10349\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/10399\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/10400\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.debian.org/security/2004/dsa-429\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.kb.cert.org/vuls/id/940388\",\"source\":\"cve@mitre.org\",\"tags\":[\"US Government Resource\"]},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDKSA-2003:109\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.novell.com/linux/security/advisories/2003_048_gpg.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2003-390.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2003-395.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/9115\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10982\",\"source\":\"cve@mitre.org\"},{\"url\":\"ftp://patches.sgi.com/support/free/security/advisories/20040202-01-U.asc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000798\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.gnupg.org/pipermail/gnupg-announce/2003q4/000276.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://lists.gnupg.org/pipermail/gnupg-announce/2003q4/000277.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=106995769213221\u0026w=2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/10304\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/10349\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/10399\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/10400\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.debian.org/security/2004/dsa-429\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.kb.cert.org/vuls/id/940388\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"US Government Resource\"]},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDKSA-2003:109\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.novell.com/linux/security/advisories/2003_048_gpg.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2003-390.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2003-395.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/9115\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10982\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…