bugtraq - CVE-2019-6690: Improper Input Validation in python-gnupg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20190125095823.27qebxdslroxvxq2@georgiou>
Date: Fri, 25 Jan 2019 10:58:23 +0100
From: Stig Palmquist <stig@...g.io>
To: bugtraq@...urityfocus.com
Cc: alexander.kjall@...il.com
Subject: CVE-2019-6690: Improper Input Validation in python-gnupg

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

CVE-2019-6690: Improper Input Validation in python-gnupg
========================================================

We discovered a way to inject data through the passphrase property of
the gnupg.GPG.encrypt() and gnupg.GPG.decrypt() methods when symmetric
encryption is used.

The supplied passphrase is not validated for newlines, and the library
passes --passphrase-fd=0 to the gpg executable, which expects the
passphrase on the first line of stdin, and the ciphertext to be
decrypted or plaintext to be encrypted on subsequent lines.

By supplying a passphrase containing a newline an attacker can
control/modify the ciphertext/plaintext being decrypted/encrypted.

Vulnerable
- ----------
python-gnupg 0.4.3, and maybe earlier versions.

Mitigation
- ----------
Users should upgrade to 0.4.4.

Timeline
- --------
2019-01-19: Vulnerability discovered during Insomni’hack teaser 2019
2019-01-20: PoC created
2019-01-22: Applied for CVE, vendor notified
2019-01-23: CVE-2019-6690 assigned
2019-01-23: Vendor responded, fix committed
2019-01-24: Vendor released 0.4.4

References
- ----------
https://pypi.org/project/python-gnupg/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6690
https://blog.hackeriet.no/cve-2019-6690-python-gnupg-vulnerability/
https://github.com/hackeriet/CVE-2019-6690-python-gnupg-vulnerability
https://ctftime.org/task/7458

Proof of Concept
- ----------------
Hypothetical application using successful decryption of data to authenticate a
user, and a way to exploit it is available here:

https://blog.hackeriet.no/assets/CVE-2019-6690-python-gnupg-vulnerability.tgz
https://blog.hackeriet.no/assets/CVE-2019-6690-python-gnupg-vulnerability.tgz.sig

Credits
- -------
Vulnerability discovered by Alexander Kjäll and Stig Palmquist.

Thanks to @dewaelethom who wrote the CTF challenge.
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEj7OMIAQn+GdSU5z5EMg4owYJR3UFAlxK3b4ACgkQEMg4owYJ
R3XWpQ/9Ex7/vIH6k6gFXk2SXTEK19g8D1zsopPsQaE/uzvAARJrdGe0mxAtlqWo
Z5C/4w+4B4ioLK8wphFiFglvwNN/qxeTOXR3z5RoVbNSvd4BQ1GQR23N+rqob12P
Q4TorKNPjgvlG28aP1O3gywX0vAPtD6N3UITuFgEkUg22jF5vrWns8iX8jPzXfE+
y8FzXnydFXgLJy9+BPIKQ+cNz/jK341WbMav2AUNTWxlbgDymyBNYuWVK7QarFM4
93svE4Pg91EdsLzHctNNwMUg43pQgpnGaw5bUFA4LtNMSElu66Qdr7ZK3ViHrbWB
qXEPcbD3el7R4TJxfxVpJtpplMCRF+xDDOBbEVN5i37Ma2WRWVGuhizcZUS7V4Af
RvDl38o6aIX3ZHRlxIb2pG0FpQDC4Dzh0GCsEinYZCmvLfAu4OzcD0V+GPLmR21L
CzfaGBZJlv5d3poDC/uo5Pi6QOo2I0A6sp3ap76CNpEp/jMzWOkwAvTaYNWnJ51A
WzJecxYcf3qXPW+olR8QWqLydz96WEdJFB8xF5gS354eWV3FpYcaedqZVSwJYpGD
XLZ0lxEa2PGZvcXJ7XZzs4jNwqaisFELto/GLDVxzRFx1U3oe86rTO4KF+IyYUB7
+bFayUfunzmX3QQYzHVj6KgUh19heb6DpFxDp7kWMKxFPJRr6q8=
=7ajV
-----END PGP SIGNATURE-----