CVE-2006-0455

gpgv in GnuPG before 1.4.2.1, when using unattended signature verification, returns a 0 exit code in certain cases even when the detached signature file does not carry a signature, which could cause programs that use gpgv to assume that the signature verification has succeeded. Note: this also occurs when running the equivalent command "gpg --verify".

Affected products

Gnupg, Red Hat, Suse Linux Enterprise, Gpg, Liby2Util, Liby2Util-Devel, Opensuse

Gnu Privacy Guard

= 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.3b, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.2, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.2.7, 1.3.3, 1.3.4, 1.4, 1.4.1, 1.4.2

CVSS 2.0

4.6 MEDIUM

EPSS

1.4% (70th percentile)

NVD status

Modified

Published

2006-02-15