CVE-2018-12020
dirmngr: mainproc.c in GnuPG before 2.2.8 mishandles the original filename duringdecryption and verification actions, which al...
CVE-2018-12020 is fixed in 20 products on 1 platform, first by dirmngr 2.2.4-1ubuntu1.1, released June 7, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0825
94th percentile
mainproc.c in GnuPG before 2.2.8 mishandles the original filename duringdecryption and verification actions, which allows remote attackers to spoofthe output that GnuPG sends on file descriptor 2 to other programs that usethe "--status-fd 2" option. For example, the OpenPGP data might representan original filename that contains line feed characters in conjunction withGOODSIG or VALIDSIG status codes.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| dirmngr · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | dirmngr 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| dirmngr · Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | dirmngr 2.2.8-1ubuntu1 | Jun 8, 2018 |
| dirmngr · Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | dirmngr 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gnupg · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gnupg 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gnupg · Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | gnupg 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gnupg · Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | gnupg 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gnupg-agent · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gnupg-agent 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gnupg-agent · Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | gnupg-agent 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gnupg-agent · Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | gnupg-agent 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gnupg-l10n · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gnupg-l10n 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gnupg-l10n · Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | gnupg-l10n 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gnupg-l10n · Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | gnupg-l10n 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gnupg-utils · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gnupg-utils 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gnupg-utils · Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | gnupg-utils 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gnupg-utils · Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | gnupg-utils 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gnupg2 · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gnupg2 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gnupg2 · Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | gnupg2 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gnupg2 · Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | gnupg2 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gpg · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gpg 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gpg · Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | gpg 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gpg · Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | gpg 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gpg-agent · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gpg-agent 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gpg-agent · Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | gpg-agent 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gpg-agent · Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | gpg-agent 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gpg-wks-client · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gpg-wks-client 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gpg-wks-client · Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | gpg-wks-client 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gpg-wks-client · Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | gpg-wks-client 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gpg-wks-server · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gpg-wks-server 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gpg-wks-server · Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | gpg-wks-server 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gpg-wks-server · Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | gpg-wks-server 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gpgconf · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gpgconf 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gpgconf · Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | gpgconf 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gpgconf · Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | gpgconf 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gpgsm · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gpgsm 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gpgsm · Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | gpgsm 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gpgsm · Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | gpgsm 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gpgv · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gpgv 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gpgv · Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | gpgv 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gpgv · Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | gpgv 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gpgv-static · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gpgv-static 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gpgv-static · Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | gpgv-static 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gpgv-static · Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | gpgv-static 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gpgv-win32 · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gpgv-win32 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gpgv-win32 · Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | gpgv-win32 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gpgv-win32 · Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | gpgv-win32 2.2.8-1ubuntu1 | Jun 8, 2018 |
| gpgv2 · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gpgv2 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| keyboxd · Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | keyboxd 2.2.8-1ubuntu1 | Jun 8, 2018 |
| keyboxd · Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | keyboxd 2.2.8-1ubuntu1 | Jun 8, 2018 |
| python-gnupg · Ubuntu 18.04.6 LTS (bionic) | 0.4.1-1ubuntu1.18.04.1 | python-gnupg 0.4.1-1ubuntu1.18.04.1 | Mar 20, 2019 |
| python3-gnupg · Ubuntu 18.04.6 LTS (bionic) | 0.4.1-1ubuntu1.18.04.1 | python3-gnupg 0.4.1-1ubuntu1.18.04.1 | Mar 20, 2019 |
| scdaemon · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | scdaemon 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| scdaemon · Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | scdaemon 2.2.8-1ubuntu1 | Jun 8, 2018 |
| scdaemon · Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | scdaemon 2.2.8-1ubuntu1 | Jun 8, 2018 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.