CVE-2022-34903 json
GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information...
published 2022-07-01 4 y ago modified 2026-07-25 3 mo ago also EUVD-2022-37807 , JLSEC-2025-92
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.8%
- EPSS 2.8% chance of exploitation in 30 days, percentile 86%
- public exploits
- 0
- none known
Summary
GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line.
Patch / fix
- julia GnuPG_jll 2.4.7+0
- gnupg2 Debian 14, Debian 13, Debian 12 2.2.35-3
debian advisories DEBIAN-CVE-2022-34903
- gnupg2 Ubuntu 18.04 LTS 2.2.4-1ubuntu1.6
- gnupg2 Ubuntu 20.04 LTS 2.2.19-3ubuntu2.2
- gnupg2 Ubuntu 22.04 LTS 2.2.27-3ubuntu2.1
- gnupg Ubuntu Pro 14.04 LTS 1.4.16-1ubuntu2.6+esm1
- gnupg Ubuntu Pro 16.04 LTS 1.4.20-1ubuntu3.3+esm2
- gnupg2 Ubuntu Pro 16.04 LTS 2.1.11-6ubuntu2.1+esm1
ubuntu advisories UBUNTU-CVE-2022-34903
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- gnupg2 RHEL 9 2.3.3-2.el9_0
- gnupg2-smime RHEL 9 2.3.3-2.el9_0
- gnupg2 RHEL 8 2.2.20-3.el8_6
- gnupg2-smime RHEL 8 2.2.20-3.el8_6
red hat advisories RHSA-2022:6602RHSA-2022:6463
- gpg2 SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES for SAP 15 +16 more 2.2.5-150000.4.22.1
- gpg2 SLE Module for Basesystem 15 SP4, SLE Module for Basesystem 15 SP3, SLE Micro 5.2 +3 more 2.2.27-150300.3.5.1
- gpg2 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +5 more 2.0.24-9.11.1
suse advisories SUSE-SU-2022:3144-1SUSE-SU-2022:2546-1SUSE-SU-2022:2529-1
- gpg2 openSUSE Tumbleweed 2.3.7-1.1
- gpg2 openSUSE Leap Micro 5.2 2.2.27-150300.3.5.1
opensuse advisories openSUSE-SU-2024:12215-1openSUSE-SU-2022:2546-1
- gnupg2 AlmaLinux 9 2.3.3-2.el9_0
- gnupg2-smime AlmaLinux 9 2.3.3-2.el9_0
- gnupg2 AlmaLinux 8 2.2.20-3.el8_6
- gnupg2-smime AlmaLinux 8 2.2.20-3.el8_6
almalinux advisories ALSA-2022:6602ALSA-2022:6463
- gnupg2 Rocky Linux 9 2.3.3-2.el9_0
- gnupg2 Rocky Linux 8 2.2.20-3.el8_6
rocky linux advisories RLSA-2022:6602RLSA-2022:6463
- gnupg Alpine 3.14, Alpine 3.13 2.2.31-r1
- gnupg Alpine 3.15 2.2.31-r2
- gnupg Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 2.2.35-r4
alpine advisories ALPINE-CVE-2022-34903
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- gnupg2 CBL-Mariner 2.0 2.3.7-1
azure linux advisories AZL-10074
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
- gnupg Arch Linux 2.2.36-1
arch linux advisories AVG-2776
- bugs.debian.org/1014157 advisory
- dev.gnupg.org/T6027 advisory
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2022-34903 updated cvss 5.9
gpg: Signature spoofing via status line injection
-
Red Hat Enterprise Linux 6 gnupg2, gnupg2-smime Red Hat Enterprise Linux 7 gnupg2, gnupg2-smimeaffected: no fix planned “Out of support scope”
-
Red Hat Enterprise Linux AppStream (v. 9) gnupg2-smime 2.3.3-2.el9_0fixed: vendor fix RHSA-2022:6602
-
Red Hat Enterprise Linux BaseOS (v. 8) gnupg2 2.2.20-3.el8_6, gnupg2-smime 2.2.20-3.el8_6fixed: vendor fix RHSA-2022:6463
-
Red Hat Enterprise Linux BaseOS (v. 9) gnupg2 2.3.3-2.el9_0fixed: vendor fix RHSA-2022:6602
-
Red Hat Enterprise Linux 6 gpgme Red Hat Enterprise Linux 7 gpgme Red Hat Enterprise Linux 8 gpgme, qgpgme, gpgmepp, python3-gpg Red Hat Enterprise Linux 9 gpgme, qgpgme, gpgmepp, python3-gpgnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-24-046-11 updated cvss 6.5
Siemens SCALANCE XCM-/XRM-300
-
Siemens SCALANCE XCH328 (6GK5328-4TS01-2EC2) <V2.4 Siemens SCALANCE XCM324 (6GK5324-8TS01-2AC2) <V2.4 Siemens SCALANCE XCM328 (6GK5328-4TS01-2AC2) <V2.4 Siemens SCALANCE XCM332 (6GK5332-0GA01-2AC2) <V2.4 Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) <V2.4 Siemens SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) <V2.4affected: fixed in V2.4 support.industry.siemens.com
+5 more productsfewer
Siemens SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) <V2.4
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
Exploit prediction
2.84% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- openwall.com https://www.openwall.com/lists/oss-security/2022/06/30/1 referenced PoC, tagged "exploit" by a source, unverified
- openwall.com http://www.openwall.com/lists/oss-security/2022/07/02/1 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N |
| NVD | 2.0 | 5.8 | AV:N/AC:M/Au:N/C:P/I:P/A:N |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| julia | GnuPG_jll | <2.4.7+0 |
2.4.7+0 |
Classification
- Weakness
-
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
References
-
bugs.debian.org
/1014157
issue-tracking, mailing-list, patch, third-party-advisory, web
-
dev.gnupg.org
/T6027
issue-tracking, patch, vendor-advisory, web
-
openwall.com
/lists/oss-security/2022/06/30/1
exploit, mailing-list, third-party-advisory, web
-
openwall.com
/lists/oss-security/2022/07/02/1
mailing-list, exploit, third-party-advisory, web
-
debian.org
/security/2022/dsa-5174
vendor-advisory, third-party-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/NPTAR76EIZY7NQFENSOZO7U473257OVZ/
vendor-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/VN63GBTMRWO36Y7BKA2WQHROAKCXKCBL/
vendor-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/FRLWJQ76A4UKHI3Q36BKSJKS4LFLQO33/
vendor-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/VU64FUVG2PRZBSHFOQRSP7KDVEIZ23OS/
vendor-advisory, web
-
security.netapp.com
/advisory/ntap-20220826-0005/
third-party-advisory, web
Sources
- CVE List CVE-2022-34903
- NVD CVE-2022-34903
- OSV JLSEC-2025-92
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.