| Package | Affected versions | Patched versions |
|---|---|---|
| gnupg | ≥ 2.5.0, < 2.5.5< 2.4.8 | 2.5.52.4.8 |
In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free