CVE catalog

CVE-2022-34903

gnupg2: CVE-2022-34903

[CVE catalog]

Severity
Medium · CVSS 6.8CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
2.84% · Oct 25, 2026

GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangnupg2sid2.4.9-8fixed
Debiangnupg2forky2.4.9-8fixed
Debiangnupg2trixie2.4.7-21+deb13u1fixed
Debiangnupg2bookworm2.2.40-1.1+deb12u2fixed
Ubuntugnupgpro1.4.18-7ubuntu1vulnerable
Ubuntugnupgpro1.4.19-6ubuntu1vulnerable
Ubuntugnupgpro1.4.20-1ubuntu1vulnerable
Ubuntugnupgpro1.4.20-1ubuntu2vulnerable
Ubuntugnupgpro1.4.20-1ubuntu3vulnerable
Ubuntugnupgpro1.4.20-1ubuntu3.1vulnerable
Ubuntugnupgpro1.4.20-1ubuntu3.2vulnerable
Ubuntugnupgpro1.4.20-1ubuntu3.3vulnerable
Ubuntugnupgpro1.4.20-1ubuntu3.3+esm2fixed
Ubuntugnupg2pro2.0.28-3ubuntu1vulnerable
Ubuntugnupg2pro2.0.28-3ubuntu2vulnerable
Ubuntugnupg2pro2.1.11-6ubuntu1vulnerable
Ubuntugnupg2pro2.1.11-6ubuntu2vulnerable
Ubuntugnupg2pro2.1.11-6ubuntu2.1vulnerable
Ubuntugnupg2pro2.1.11-6ubuntu2.1+esm1fixed
Ubuntugnupg218.042.1.15-1ubuntu8vulnerable
Ubuntugnupg218.042.2.4-1ubuntu1vulnerable
Ubuntugnupg218.042.2.4-1ubuntu1.1vulnerable
Ubuntugnupg218.042.2.4-1ubuntu1.2vulnerable
Ubuntugnupg218.042.2.4-1ubuntu1.3vulnerable
Ubuntugnupg218.042.2.4-1ubuntu1.4vulnerable
Ubuntugnupg218.042.2.4-1ubuntu1.5vulnerable
Ubuntugnupg218.042.2.4-1ubuntu1.6fixed
Ubuntugnupg220.042.2.12-1ubuntu3vulnerable
Ubuntugnupg220.042.2.17-3ubuntu1vulnerable
Ubuntugnupg220.042.2.19-3ubuntu2vulnerable
Ubuntugnupg220.042.2.19-3ubuntu2.1vulnerable
Ubuntugnupg220.042.2.19-3ubuntu2.2fixed
Ubuntugnupg222.042.2.20-1ubuntu4vulnerable
Ubuntugnupg222.042.2.27-2ubuntu1vulnerable
Ubuntugnupg222.042.2.27-3ubuntu1vulnerable
Ubuntugnupg222.042.2.27-3ubuntu2vulnerable
Ubuntugnupg222.042.2.27-3ubuntu2.1fixed
Ubuntugnupgpro1.4.18-7ubuntu1vulnerable
Ubuntugnupgpro1.4.19-6ubuntu1vulnerable
Ubuntugnupgpro1.4.20-1ubuntu1vulnerable
Ubuntugnupgpro1.4.20-1ubuntu2vulnerable
Ubuntugnupgpro1.4.20-1ubuntu3vulnerable
Ubuntugnupgpro1.4.20-1ubuntu3.1vulnerable
Ubuntugnupgpro1.4.20-1ubuntu3.2vulnerable
Ubuntugnupgpro1.4.20-1ubuntu3.3vulnerable
Ubuntugnupgpro1.4.20-1ubuntu3.3+esm2fixed
Ubuntugnupg2pro2.0.28-3ubuntu1vulnerable
Ubuntugnupg2pro2.0.28-3ubuntu2vulnerable
Ubuntugnupg2pro2.1.11-6ubuntu1vulnerable
Ubuntugnupg2pro2.1.11-6ubuntu2vulnerable
Ubuntugnupg2pro2.1.11-6ubuntu2.1vulnerable
Ubuntugnupg2pro2.1.11-6ubuntu2.1+esm1fixed
Ubuntugnupg218.042.1.15-1ubuntu8vulnerable
Ubuntugnupg218.042.2.4-1ubuntu1vulnerable
Ubuntugnupg218.042.2.4-1ubuntu1.1vulnerable
Ubuntugnupg218.042.2.4-1ubuntu1.2vulnerable
Ubuntugnupg218.042.2.4-1ubuntu1.3vulnerable
Ubuntugnupg218.042.2.4-1ubuntu1.4vulnerable
Ubuntugnupg218.042.2.4-1ubuntu1.5vulnerable
Ubuntugnupg218.042.2.4-1ubuntu1.6fixed
Ubuntugnupg220.042.2.12-1ubuntu3vulnerable
Ubuntugnupg220.042.2.17-3ubuntu1vulnerable
Ubuntugnupg220.042.2.19-3ubuntu2vulnerable
Ubuntugnupg220.042.2.19-3ubuntu2.1vulnerable
Ubuntugnupg220.042.2.19-3ubuntu2.2fixed
Ubuntugnupg222.042.2.20-1ubuntu4vulnerable
Ubuntugnupg222.042.2.27-2ubuntu1vulnerable
Ubuntugnupg222.042.2.27-3ubuntu1vulnerable
Ubuntugnupg222.042.2.27-3ubuntu2vulnerable
Ubuntugnupg222.042.2.27-3ubuntu2.1fixed
Susegpg2openstack cloud 92.0.24-9.11.1fixed
Susegpg2openstack cloud crowbar 92.0.24-9.11.1fixed
Susegpg2linux enterprise server for sap applications 12 sp42.0.24-9.11.1fixed
Susegpg2linux enterprise server 12 sp2-bcl2.0.24-9.11.1fixed
Susegpg2linux enterprise server 12 sp3-bcl2.0.24-9.11.1fixed
Susegpg2linux enterprise server 12 sp4-ltss2.0.24-9.11.1fixed
Susegpg2linux enterprise server 12 sp52.0.24-9.11.1fixed
Susegpg2linux enterprise server for sap applications 12 sp52.0.24-9.11.1fixed
Susegpg2linux enterprise module for basesystem 15 sp32.2.27-150300.3.5.1fixed
Susegpg2linux enterprise module for basesystem 15 sp42.2.27-150300.3.5.1fixed
Susegpg2linux enterprise micro 5.12.2.27-150300.3.5.1fixed
Susegpg2linux enterprise micro 5.22.2.27-150300.3.5.1fixed
Opensusegpg2leap 15.32.2.27-150300.3.5.1fixed
Opensusegpg2leap 15.42.2.27-150300.3.5.1fixed
Opensusegpg2tumbleweed2.3.7-1.1fixed
Opensusegpg2leap micro 5.22.2.27-150300.3.5.1fixed
Susegpg2linux enterprise high performance computing 15-espos2.2.5-150000.4.22.1fixed
Susegpg2linux enterprise high performance computing 15-ltss2.2.5-150000.4.22.1fixed
Susegpg2linux enterprise high performance computing 15 sp1-espos2.2.5-150000.4.22.1fixed
Susegpg2linux enterprise high performance computing 15 sp1-ltss2.2.5-150000.4.22.1fixed
Susegpg2linux enterprise high performance computing 15 sp2-espos2.2.5-150000.4.22.1fixed
Susegpg2linux enterprise high performance computing 15 sp2-ltss2.2.5-150000.4.22.1fixed
Susegpg2linux enterprise server 15-ltss2.2.5-150000.4.22.1fixed
Susegpg2linux enterprise server 15 sp1-bcl2.2.5-150000.4.22.1fixed
Susegpg2linux enterprise server 15 sp1-ltss2.2.5-150000.4.22.1fixed
Susegpg2linux enterprise server 15 sp2-bcl2.2.5-150000.4.22.1fixed
Susegpg2linux enterprise server 15 sp2-ltss2.2.5-150000.4.22.1fixed
Susegpg2linux enterprise server for sap applications 152.2.5-150000.4.22.1fixed
Susegpg2linux enterprise server for sap applications 15 sp12.2.5-150000.4.22.1fixed
Susegpg2linux enterprise server for sap applications 15 sp22.2.5-150000.4.22.1fixed
Susegpg2manager proxy 4.12.2.5-150000.4.22.1fixed
Susegpg2manager retail branch server 4.12.2.5-150000.4.22.1fixed
Susegpg2manager server 4.12.2.5-150000.4.22.1fixed
Susegpg2enterprise storage 62.2.5-150000.4.22.1fixed
Susegpg2enterprise storage 72.2.5-150000.4.22.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangnupg2sourcesid2.2.35-3not yet assignedNot reported[1014157]
Debiangnupg2sourceforky2.2.35-3not yet assignedNot reported[1014157]
Debiangnupg2sourcetrixie2.2.35-3not yet assignedNot reported[1014157]
Debiangnupg2sourcebookworm2.2.35-3not yet assignedNot reported[1014157]
Ubuntugnupgdebpro1.4.20-1ubuntu3.3+esm2Not reportedUSN-5503-2Not reported
Ubuntugnupg2debpro2.1.11-6ubuntu2.1+esm1Not reportedUSN-5503-2Not reported
Ubuntugnupg2deb18.042.2.4-1ubuntu1.6Not reportedUSN-5503-1Not reported
Ubuntugnupg2deb20.042.2.19-3ubuntu2.2Not reportedUSN-5503-1Not reported
Ubuntugnupg2deb22.042.2.27-3ubuntu2.1Not reportedUSN-5503-1Not reported
Ubuntugnupgdebpro1.4.20-1ubuntu3.3+esm2Not reportedUBUNTU-CVE-2022-34903Not reported
Ubuntugnupg2debpro2.1.11-6ubuntu2.1+esm1Not reportedUBUNTU-CVE-2022-34903Not reported
Ubuntugnupg2deb18.042.2.4-1ubuntu1.6Not reportedUBUNTU-CVE-2022-34903Not reported
Ubuntugnupg2deb20.042.2.19-3ubuntu2.2Not reportedUBUNTU-CVE-2022-34903Not reported
Ubuntugnupg2deb22.042.2.27-3ubuntu2.1Not reportedUBUNTU-CVE-2022-34903Not reported
Susegpg2rpmopenstack cloud 92.0.24-9.11.1Not reportedSUSE-SU-2022:2529-1Not reported
Susegpg2rpmopenstack cloud crowbar 92.0.24-9.11.1Not reportedSUSE-SU-2022:2529-1Not reported
Susegpg2rpmlinux enterprise server for sap applications 12 sp42.0.24-9.11.1Not reportedSUSE-SU-2022:2529-1Not reported
Susegpg2rpmlinux enterprise server 12 sp2-bcl2.0.24-9.11.1Not reportedSUSE-SU-2022:2529-1Not reported
Susegpg2rpmlinux enterprise server 12 sp3-bcl2.0.24-9.11.1Not reportedSUSE-SU-2022:2529-1Not reported
Susegpg2rpmlinux enterprise server 12 sp4-ltss2.0.24-9.11.1Not reportedSUSE-SU-2022:2529-1Not reported
Susegpg2rpmlinux enterprise server 12 sp52.0.24-9.11.1Not reportedSUSE-SU-2022:2529-1Not reported
Susegpg2rpmlinux enterprise server for sap applications 12 sp52.0.24-9.11.1Not reportedSUSE-SU-2022:2529-1Not reported
Susegpg2rpmlinux enterprise module for basesystem 15 sp32.2.27-150300.3.5.1Not reportedSUSE-SU-2022:2546-1Not reported
Susegpg2rpmlinux enterprise module for basesystem 15 sp42.2.27-150300.3.5.1Not reportedSUSE-SU-2022:2546-1Not reported
Susegpg2rpmlinux enterprise micro 5.12.2.27-150300.3.5.1Not reportedSUSE-SU-2022:2546-1Not reported
Susegpg2rpmlinux enterprise micro 5.22.2.27-150300.3.5.1Not reportedSUSE-SU-2022:2546-1Not reported
Opensusegpg2rpmleap 15.32.2.27-150300.3.5.1Not reportedSUSE-SU-2022:2546-1Not reported
Opensusegpg2rpmleap 15.42.2.27-150300.3.5.1Not reportedSUSE-SU-2022:2546-1Not reported
Opensusegpg2rpmtumbleweed2.3.7-1.1Not reportedOPENSUSE-SU-2024:12215-1Not reported
Opensusegpg2rpmleap micro 5.22.2.27-150300.3.5.1Not reportedOPENSUSE-SU-2022:2546-1Not reported
Susegpg2rpmlinux enterprise high performance computing 15-espos2.2.5-150000.4.22.1Not reportedSUSE-SU-2022:3144-1Not reported
Susegpg2rpmlinux enterprise high performance computing 15-ltss2.2.5-150000.4.22.1Not reportedSUSE-SU-2022:3144-1Not reported
Susegpg2rpmlinux enterprise high performance computing 15 sp1-espos2.2.5-150000.4.22.1Not reportedSUSE-SU-2022:3144-1Not reported
Susegpg2rpmlinux enterprise high performance computing 15 sp1-ltss2.2.5-150000.4.22.1Not reportedSUSE-SU-2022:3144-1Not reported
Susegpg2rpmlinux enterprise high performance computing 15 sp2-espos2.2.5-150000.4.22.1Not reportedSUSE-SU-2022:3144-1Not reported
Susegpg2rpmlinux enterprise high performance computing 15 sp2-ltss2.2.5-150000.4.22.1Not reportedSUSE-SU-2022:3144-1Not reported
Susegpg2rpmlinux enterprise server 15-ltss2.2.5-150000.4.22.1Not reportedSUSE-SU-2022:3144-1Not reported
Susegpg2rpmlinux enterprise server 15 sp1-bcl2.2.5-150000.4.22.1Not reportedSUSE-SU-2022:3144-1Not reported
Susegpg2rpmlinux enterprise server 15 sp1-ltss2.2.5-150000.4.22.1Not reportedSUSE-SU-2022:3144-1Not reported
Susegpg2rpmlinux enterprise server 15 sp2-bcl2.2.5-150000.4.22.1Not reportedSUSE-SU-2022:3144-1Not reported
Susegpg2rpmlinux enterprise server 15 sp2-ltss2.2.5-150000.4.22.1Not reportedSUSE-SU-2022:3144-1Not reported
Susegpg2rpmlinux enterprise server for sap applications 152.2.5-150000.4.22.1Not reportedSUSE-SU-2022:3144-1Not reported
Susegpg2rpmlinux enterprise server for sap applications 15 sp12.2.5-150000.4.22.1Not reportedSUSE-SU-2022:3144-1Not reported
Susegpg2rpmlinux enterprise server for sap applications 15 sp22.2.5-150000.4.22.1Not reportedSUSE-SU-2022:3144-1Not reported
Susegpg2rpmmanager proxy 4.12.2.5-150000.4.22.1Not reportedSUSE-SU-2022:3144-1Not reported
Susegpg2rpmmanager retail branch server 4.12.2.5-150000.4.22.1Not reportedSUSE-SU-2022:3144-1Not reported
Susegpg2rpmmanager server 4.12.2.5-150000.4.22.1Not reportedSUSE-SU-2022:3144-1Not reported
Susegpg2rpmenterprise storage 62.2.5-150000.4.22.1Not reportedSUSE-SU-2022:3144-1Not reported
Susegpg2rpmenterprise storage 72.2.5-150000.4.22.1Not reportedSUSE-SU-2022:3144-1Not reported

[Debian bug #1014157]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [dirmngr]Unknown

    Source package: [gpg2]

    Details (1)
    • 2.5.21-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.3.7-1.1

      Version impact unknown

      dsa · gpg2 · opensuse · tumbleweed

  • [gpg2-lang]Unknown

    Source package: [gpg2]

    Details (1)
    • 2.5.21-1.2 · noarch · tumbleweed

      Unknown · Fixed: 2.3.7-1.1

      Version impact unknown

      dsa · gpg2 · opensuse · tumbleweed

  • [gpg2-tpm]Unknown

    Source package: [gpg2]

    Details (1)
    • 2.5.21-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.3.7-1.1

      Version impact unknown

      dsa · gpg2 · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [dirmngr]Fixed

    Source package: [gnupg2]

    Details (2)
    • 2.2.40-1.1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

    • 2.2.40-1.1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

  • [gnupg]Fixed

    Source package: [gnupg2]

    Details (2)
    • 2.2.40-1.1+deb12u2 · all · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

    • 2.2.40-1.1+deb12u2 · all · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

  • [gnupg2]Fixed
    Details (2)
    • 2.2.40-1.1+deb12u2 · all · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

    • 2.2.40-1.1+deb12u2 · all · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

  • Source package: [gnupg2]

    Details (2)
    • 2.2.40-1.1+deb12u2 · all · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

    • 2.2.40-1.1+deb12u2 · all · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

  • [gnupg-l10n]Fixed

    Source package: [gnupg2]

    Details (2)
    • 2.2.40-1.1+deb12u2 · all · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

    • 2.2.40-1.1+deb12u2 · all · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

  • Source package: [gnupg2]

    Details (2)
    • 2.2.40-1.1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

    • 2.2.40-1.1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

  • [gpg]Fixed

    Source package: [gnupg2]

    Details (2)
    • 2.2.40-1.1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

    • 2.2.40-1.1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

  • [gpg-agent]Fixed

    Source package: [gnupg2]

    Details (2)
    • 2.2.40-1.1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

    • 2.2.40-1.1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

  • [gpgconf]Fixed

    Source package: [gnupg2]

    Details (2)
    • 2.2.40-1.1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

    • 2.2.40-1.1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

  • [gpgsm]Fixed

    Source package: [gnupg2]

    Details (2)
    • 2.2.40-1.1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

    • 2.2.40-1.1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

  • [gpgv]Fixed

    Source package: [gnupg2]

    Details (2)
    • 2.2.40-1.1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

    • 2.2.40-1.1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

  • [gpgv2]Fixed

    Source package: [gnupg2]

    Details (2)
    • 2.2.40-1.1+deb12u2 · all · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

    • 2.2.40-1.1+deb12u2 · all · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

  • Source package: [gnupg2]

    Details (2)
    • 2.2.40-1.1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

    • 2.2.40-1.1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

  • [gpgv-win32]Fixed

    Source package: [gnupg2]

    Details (2)
    • 2.2.40-1.1+deb12u2 · all · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

    • 2.2.40-1.1+deb12u2 · all · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

  • Source package: [gnupg2]

    Details (2)
    • 2.2.40-1.1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

    • 2.2.40-1.1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

  • Source package: [gnupg2]

    Details (2)
    • 2.2.40-1.1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

    • 2.2.40-1.1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

  • [scdaemon]Fixed

    Source package: [gnupg2]

    Details (2)
    • 2.2.40-1.1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

    • 2.2.40-1.1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.2.35-3

      dsa · gnupg2 · debian · bookworm

Next results

Observed:

References