CVE-2018-9234
dirmngr: GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify...
CVE-2018-9234 is fixed in 17 products on 1 platform, first by dirmngr 2.2.4-1ubuntu1.1, released June 7, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Low
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0196
80th percentile
GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| dirmngr · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | dirmngr 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gnupg · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gnupg 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gnupg-agent · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gnupg-agent 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gnupg-l10n · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gnupg-l10n 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gnupg-utils · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gnupg-utils 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gnupg2 · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gnupg2 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gpg · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gpg 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gpg-agent · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gpg-agent 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gpg-wks-client · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gpg-wks-client 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gpg-wks-server · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gpg-wks-server 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gpgconf · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gpgconf 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gpgsm · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gpgsm 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gpgv · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gpgv 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gpgv-static · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gpgv-static 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gpgv-win32 · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gpgv-win32 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| gpgv2 · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | gpgv2 2.2.4-1ubuntu1.1 | Jun 7, 2018 |
| scdaemon · Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | scdaemon 2.2.4-1ubuntu1.1 | Jun 7, 2018 |