GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3857-1 advisory.

  - GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline     master Certify key, which results in apparently valid certifications that occurred only with access to a     signing subkey. (CVE-2018-9234)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the gnupg2 package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - GnuPG 2.2.4 and 2.2.5 does not enforce a configuration     in which key certification requires an offline master     Certify key, which results in apparently valid     certifications that occurred only with access to a     signing subkey.(CVE-2018-9234)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the gnupg2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - GnuPG 2.2.4 and 2.2.5 does not enforce a configuration     in which key certification requires an offline master     Certify key, which results in apparently valid     certifications that occurred only with access to a     signing subkey.(CVE-2018-9234)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the gnupg2 package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - GnuPG 2.2.4 and 2.2.5 does not enforce a configuration     in which key certification requires an offline master     Certify key, which results in apparently valid     certifications that occurred only with access to a     signing subkey.(CVE-2018-9234)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the gnupg2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - GnuPG 2.2.4 and 2.2.5 does not enforce a configuration     in which key certification requires an offline master     Certify key, which results in apparently valid     certifications that occurred only with access to a     signing subkey.(CVE-2018-9234)

  - The do_uncompress function in g10/compress.c in GnuPG     1.x before 1.4.17 and 2.x before 2.0.24 allows     context-dependent attackers to cause a denial of     service (infinite loop) via malformed compressed     packets, as demonstrated by an a3 01 5b ff byte     sequence.(CVE-2014-4617)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Minor update from upstream with fix for CVE-2018-9234 and other bug fixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Marcus Brinkmann discovered that during decryption or verification, GnuPG did not properly filter out terminal sequences when reporting the original filename. An attacker could use this to specially craft a file that would cause an application parsing GnuPG output to incorrectly interpret the status of the cryptographic operation reported by GnuPG. (CVE-2018-12020)

Lance Vick discovered that GnuPG did not enforce configurations where key certification required an offline master Certify key. An attacker with access to a signing subkey could generate certifications that appeared to be valid. This issue only affected Ubuntu 18.04 LTS.
(CVE-2018-9234).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Unenforced configuration allows for apparently valid certifications actually signed by signing subkeys :

GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey. (CVE-2018-9234)

ID	Name	Product	Family	Severity
182182	SUSE SLES12 Security Update : gpg2 (SUSE-SU-2023:3857-1)	Nessus	SuSE Local Security Checks	high
148057	EulerOS 2.0 SP5 : gnupg2 (EulerOS-SA-2021-1677)	Nessus	Huawei Local Security Checks	high
147534	EulerOS Virtualization 3.0.2.6 : gnupg2 (EulerOS-SA-2021-1435)	Nessus	Huawei Local Security Checks	high
147433	EulerOS Virtualization 3.0.6.6 : gnupg2 (EulerOS-SA-2021-1479)	Nessus	Huawei Local Security Checks	high
147431	EulerOS Virtualization for ARM 64 3.0.2.0 : gnupg2 (EulerOS-SA-2021-1406)	Nessus	Huawei Local Security Checks	high
132124	EulerOS 2.0 SP3 : gnupg2 (EulerOS-SA-2019-2589)	Nessus	Huawei Local Security Checks	high
131885	EulerOS 2.0 SP2 : gnupg2 (EulerOS-SA-2019-2393)	Nessus	Huawei Local Security Checks	high
120838	Fedora 28 : gnupg2 (2018-da6a17e6a3)	Nessus	Fedora Local Security Checks	high
110475	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : GnuPG vulnerabilities (USN-3675-1)	Nessus	Ubuntu Local Security Checks	high
110199	Amazon Linux AMI : gnupg2 (ALAS-2018-1025)	Nessus	Amazon Linux Local Security Checks	high
109095	Fedora 26 : gnupg2 (2018-42a426b17e)	Nessus	Fedora Local Security Checks	high
109048	Fedora 27 : gnupg2 (2018-3fc05e009d)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2018-9234

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high