CVE-2014-4617

What it actually does

Malformed compressed packets trigger an infinite loop inside the do_uncompress routine in GnuPG's decompression code, consuming CPU until the process is terminated.

Why it matters to the business

Cryptographic operations such as decrypting email or verifying signatures can hang indefinitely, disrupting workflows that rely on GnuPG and forcing manual restarts or process kills.

How an attack unfolds

An attacker constructs a compressed data packet containing an invalid sequence that the decompression parser cannot handle, supplies the packet through any channel that GnuPG processes (email attachment, file, or piped input), and causes the target GnuPG instance to enter an unrecoverable loop.

How to fix it

Upgrade GnuPG 1.x installations to version 1.4.17 or newer and GnuPG 2.x installations to version 2.0.24 or newer; rebuild any dependent packages that statically link against the vulnerable library.

How to confirm the fix worked

Confirm installed version is at or above the fixed releases; replay the known malformed packet sequence in a controlled test environment and verify the process terminates cleanly instead of looping.

Typical attack path

1. Generate a compressed packet containing the malformed byte sequence
2. Deliver the packet to a system running an affected GnuPG version
3. Invoke GnuPG to process the packet during decryption, verification, or import
4. Observe the process enter an infinite loop and cease responding

How to detect it

Search process accounting or system logs for gnupg or gpg processes that exhibit sustained high CPU usage without completing; examine any available GnuPG debug or error logs for repeated decompression attempts.

What your security team should do

• Prioritize patching all GnuPG instances to the fixed releases listed in remediation guidance
• Inventory systems and containers that include gnupg or gnupg2 packages
• Add version checks for gnupg to regular vulnerability scanning policies