CVE catalog

CVE-2022-24953

php-crypt-gpg: CVE-2022-24953

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.85% · Oct 25, 2026

The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianphp-crypt-gpgsid2.0.0-2fixed
Debianphp-crypt-gpgforky2.0.0-2fixed
Debianphp-crypt-gpgtrixie1.6.11-1fixed
Debianphp-crypt-gpgbookworm1.6.7-2fixed
Ubuntuphp-crypt-gpg16.041.3.2-1vulnerable
Ubuntuphp-crypt-gpg16.041.4.0-1vulnerable
Ubuntuphp-crypt-gpg16.041.4.0-1ubuntu1vulnerable
Ubuntuphp-crypt-gpg16.041.4.0-1ubuntu2vulnerable
Ubuntuphp-crypt-gpg22.041.6.4-2vulnerable
Ubuntuphp-crypt-gpg22.041.6.6-1build1vulnerable
Ubuntuphp-crypt-gpg22.041.6.7-1vulnerable
Ubuntuphp-crypt-gpg22.041.6.7-2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianphp-crypt-gpgsourcesid1.6.7-1not yet assignedNot reported[1005921]
Debianphp-crypt-gpgsourceforky1.6.7-1not yet assignedNot reported[1005921]
Debianphp-crypt-gpgsourcetrixie1.6.7-1not yet assignedNot reported[1005921]
Debianphp-crypt-gpgsourcebookworm1.6.7-1not yet assignedNot reported[1005921]

[Debian bug #1005921]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [php-crypt-gpg]Fixed
    Details (2)

    • 1.6.7-2 · all · bookworm

      Fixed · Fixed: 1.6.7-1

      dsa · php-crypt-gpg · debian · bookworm

    • 1.6.7-2 · all · bookworm

      Fixed · Fixed: 1.6.7-1

      dsa · php-crypt-gpg · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]