# CVE-2018-12020: dirmngr: mainproc.c in GnuPG before 2.2.8 mishandles the original filename duringdecryption and verification actions, which al...

CVE-2018-12020 is fixed in 20 products on 1 platform, first by dirmngr 2.2.4-1ubuntu1.1, released June 7, 2018. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2018-12020
- Priority: Routine
- CVSS: n/a (Medium)
- EPSS: 0.0825
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jun 7, 2018

## Description

mainproc.c in GnuPG before 2.2.8 mishandles the original filename duringdecryption and verification actions, which allows remote attackers to spoofthe output that GnuPG sends on file descriptor 2 to other programs that usethe "--status-fd 2" option. For example, the OpenPGP data might representan original filename that contains line feed characters in conjunction withGOODSIG or VALIDSIG status codes.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | dirmngr Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | [dirmngr 2.2.4-1ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-dirmngr-2.2.4-1ubuntu1.1.md) | Jun 7, 2018 |
| Linux | dirmngr Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | [dirmngr 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-dirmngr-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | dirmngr Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | [dirmngr 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-dirmngr-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gnupg Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | [gnupg 2.2.4-1ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-gnupg-2.2.4-1ubuntu1.1.md) | Jun 7, 2018 |
| Linux | gnupg Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | [gnupg 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-gnupg-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gnupg Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | [gnupg 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-gnupg-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gnupg-agent Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | [gnupg-agent 2.2.4-1ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-gnupg-agent-2.2.4-1ubuntu1.1.md) | Jun 7, 2018 |
| Linux | gnupg-agent Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | [gnupg-agent 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-gnupg-agent-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gnupg-agent Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | [gnupg-agent 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-gnupg-agent-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gnupg-l10n Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | [gnupg-l10n 2.2.4-1ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-gnupg-l10n-2.2.4-1ubuntu1.1.md) | Jun 7, 2018 |
| Linux | gnupg-l10n Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | [gnupg-l10n 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-gnupg-l10n-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gnupg-l10n Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | [gnupg-l10n 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-gnupg-l10n-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gnupg-utils Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | [gnupg-utils 2.2.4-1ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-gnupg-utils-2.2.4-1ubuntu1.1.md) | Jun 7, 2018 |
| Linux | gnupg-utils Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | [gnupg-utils 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-gnupg-utils-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gnupg-utils Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | [gnupg-utils 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-gnupg-utils-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gnupg2 Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | [gnupg2 2.2.4-1ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-gnupg2-2.2.4-1ubuntu1.1.md) | Jun 7, 2018 |
| Linux | gnupg2 Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | [gnupg2 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-gnupg2-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gnupg2 Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | [gnupg2 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-gnupg2-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gpg Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | [gpg 2.2.4-1ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-gpg-2.2.4-1ubuntu1.1.md) | Jun 7, 2018 |
| Linux | gpg Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | [gpg 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-gpg-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gpg Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | [gpg 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-gpg-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gpg-agent Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | [gpg-agent 2.2.4-1ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-gpg-agent-2.2.4-1ubuntu1.1.md) | Jun 7, 2018 |
| Linux | gpg-agent Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | [gpg-agent 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-gpg-agent-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gpg-agent Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | [gpg-agent 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-gpg-agent-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gpg-wks-client Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | [gpg-wks-client 2.2.4-1ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-gpg-wks-client-2.2.4-1ubuntu1.1.md) | Jun 7, 2018 |
| Linux | gpg-wks-client Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | [gpg-wks-client 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-gpg-wks-client-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gpg-wks-client Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | [gpg-wks-client 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-gpg-wks-client-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gpg-wks-server Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | [gpg-wks-server 2.2.4-1ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-gpg-wks-server-2.2.4-1ubuntu1.1.md) | Jun 7, 2018 |
| Linux | gpg-wks-server Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | [gpg-wks-server 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-gpg-wks-server-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gpg-wks-server Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | [gpg-wks-server 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-gpg-wks-server-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gpgconf Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | [gpgconf 2.2.4-1ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-gpgconf-2.2.4-1ubuntu1.1.md) | Jun 7, 2018 |
| Linux | gpgconf Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | [gpgconf 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-gpgconf-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gpgconf Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | [gpgconf 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-gpgconf-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gpgsm Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | [gpgsm 2.2.4-1ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-gpgsm-2.2.4-1ubuntu1.1.md) | Jun 7, 2018 |
| Linux | gpgsm Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | [gpgsm 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-gpgsm-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gpgsm Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | [gpgsm 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-gpgsm-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gpgv Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | [gpgv 2.2.4-1ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-gpgv-2.2.4-1ubuntu1.1.md) | Jun 7, 2018 |
| Linux | gpgv Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | [gpgv 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-gpgv-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gpgv Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | [gpgv 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-gpgv-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gpgv-static Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | [gpgv-static 2.2.4-1ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-gpgv-static-2.2.4-1ubuntu1.1.md) | Jun 7, 2018 |
| Linux | gpgv-static Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | [gpgv-static 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-gpgv-static-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gpgv-static Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | [gpgv-static 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-gpgv-static-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gpgv-win32 Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | [gpgv-win32 2.2.4-1ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-gpgv-win32-2.2.4-1ubuntu1.1.md) | Jun 7, 2018 |
| Linux | gpgv-win32 Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | [gpgv-win32 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-gpgv-win32-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gpgv-win32 Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | [gpgv-win32 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-gpgv-win32-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | gpgv2 Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | [gpgv2 2.2.4-1ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-gpgv2-2.2.4-1ubuntu1.1.md) | Jun 7, 2018 |
| Linux | keyboxd Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | [keyboxd 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-keyboxd-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | keyboxd Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | [keyboxd 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-keyboxd-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | python-gnupg Ubuntu 18.04.6 LTS (bionic) | 0.4.1-1ubuntu1.18.04.1 | [python-gnupg 0.4.1-1ubuntu1.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python-gnupg-0.4.1-1ubuntu1.18.04.1.md) | Mar 20, 2019 |
| Linux | python3-gnupg Ubuntu 18.04.6 LTS (bionic) | 0.4.1-1ubuntu1.18.04.1 | [python3-gnupg 0.4.1-1ubuntu1.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python3-gnupg-0.4.1-1ubuntu1.18.04.1.md) | Mar 20, 2019 |
| Linux | scdaemon Ubuntu 18.04.6 LTS (bionic) | 2.2.4-1ubuntu1.1 | [scdaemon 2.2.4-1ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-scdaemon-2.2.4-1ubuntu1.1.md) | Jun 7, 2018 |
| Linux | scdaemon Ubuntu 24.10 (oracular) | 2.2.8-1ubuntu1 | [scdaemon 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-scdaemon-2.2.8-1ubuntu1.md) | Jun 8, 2018 |
| Linux | scdaemon Ubuntu 25.04 (plucky) | 2.2.8-1ubuntu1 | [scdaemon 2.2.8-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-scdaemon-2.2.8-1ubuntu1.md) | Jun 8, 2018 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.