CVE-2001-0072

Published: Feb 12, 2001Modified: Apr 16, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

gpg (aka GnuPG) 1.0.4 and other versions imports both public and private keys from public key servers without notifying the user about the private keys, which could allow an attacker to break the web of trust.

Affected (5)

Products: Gnu: Privacy Guard

Gnu

1 product

Privacy Guard

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Gnu Privacy Guard	Version 1.0.1
Gnu Privacy Guard	Version 1.0.2
Gnu Privacy Guard	Version 1.0.3
Gnu Privacy Guard	Version 1.0.3b
Gnu Privacy Guard	Version 1.0

References (16)

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000368

Source: cve@mitre.org

http://www.debian.org/security/2000/20001225b

Source: cve@mitre.org

http://www.linux-mandrake.com/en/updates/2000/MDKSA-2000-087.php3

Source: cve@mitre.org

http://www.osvdb.org/1702

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2000-131.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/152197

Source: cve@mitre.org

http://www.securityfocus.com/bid/2153

Source: cve@mitre.org

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/5803

Source: cve@mitre.org

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000368