Cloudanix VulnDB

CVE-2018-1000858

High · 8.8

CVSS

8.8

EPSS

1.0%

Published

Dec 20, 2018

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in widely used encryption software could let attackers trick users into revealing information or crashing services simply by checking an email address.

Exploit Available
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Data Exposure
Component
Application
Class
CSRF
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Cross-Site Request Forgery in dirmngr component allows attacker-controlled requests that trigger information disclosure or denial of service when a victim performs a Web Key Directory (WKD) lookup.

Why it matters to the business

Attackers can obtain sensitive keyserver data or disrupt encrypted email workflows across organizations relying on GnuPG for secure communications, increasing risk of data exposure and operational downtime.

How an attack unfolds

An attacker hosts a malicious webpage that loads when the victim uses a client such as Thunderbird/Enigmail to enter an email address for a WKD request; the forged request reaches dirmngr and executes attacker-chosen actions without user consent.

How to fix it

Upgrade GnuPG to a build containing commit 4a4bb874f63741026bd26264c43bb32b1099f060 or later; apply all vendor patches for gnupg packages on affected distributions such as Ubuntu.

How to confirm the fix worked

Confirm installed GnuPG version is newer than 2.2.11 and contains the referenced commit; review dirmngr source or changelog for CSRF protections on WKD endpoints.

Typical attack path

  1. Attacker prepares malicious webpage embedding WKD request parameters
  2. Victim visits the page and triggers an email address lookup in a supported client
  3. Browser or client issues the forged request to dirmngr
  4. dirmngr processes the request allowing information disclosure or service disruption

How to detect it

Examine dirmngr logs for unexpected WKD fetch patterns originating from web browsers rather than email clients; correlate with web proxy logs showing visits to unknown domains immediately preceding keyserver queries.

What your security team should do

  • Prioritize patching GnuPG across all systems within 30 days given public exploit availability
  • Restrict outbound WKD requests from untrusted clients where feasible
  • Monitor client update status for Enigmail and similar integrations
  • Review logging configurations for dirmngr to capture anomalous WKD traffic

The record

GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Disclosure, DoS. This attack appear to be exploitable via Victim must perform a WKD request, e.g. enter an email address in the composer window of Thunderbird/Enigmail. This vulnerability appears to have been fixed in after commit 4a4bb874f63741026bd26264c43bb32b1099f060.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 gnupg2 0 2.2.12-1
Debian:12 gnupg2 0 2.2.12-1
Debian:13 gnupg2 0 2.2.12-1
Mageia:6 gnupg2 0 2.1.21-3.2.mga6
Red Hat:enterprise_linux:8::baseos gnupg2 0 0:2.2.20-2.el8
Red Hat:enterprise_linux:8::baseos gnupg2-debuginfo 0 0:2.2.20-2.el8
Red Hat:enterprise_linux:8::baseos gnupg2-debugsource 0 0:2.2.20-2.el8
Red Hat:enterprise_linux:8::baseos gnupg2-smime 0 0:2.2.20-2.el8
Red Hat:enterprise_linux:8::baseos gnupg2-smime-debuginfo 0 0:2.2.20-2.el8
Rocky Linux:8 gnupg2 0 0:2.2.20-2.el8
SUSE:Linux Enterprise Module for Basesystem 15 gpg2 0 2.2.5-4.6.2
Ubuntu:18.04:LTS gnupg2 0 2.2.4-1ubuntu1.2
openSUSE:Leap 15.0 gpg2 0 2.2.5-lp150.3.6.1

Related vulnerabilities