RHEL 2.1 : gnupg (RHSA-2003:176)

Critical Nessus Plugin ID 12396


The remote Red Hat host is missing a security update.


Updated gnupg packages are now available which correct a bug in the GnuPG key validation functions.

The GNU Privacy Guard (GnuPG) is a utility for encrypting data and creating digital signatures.

When evaluating trust values for the UIDs assigned to a given key, GnuPG versions earlier than 1.2.2 would incorrectly associate the trust value of the UID having the highest trust value with every UID assigned to this key. This would prevent an expected warning message from being generated.

All users are advised to upgrade to these errata packages which include an update to GnuPG 1.0.7 containing patches from the GnuPG development team to correct this issue.


Update the affected gnupg package.

See Also




Plugin Details

Severity: Critical

ID: 12396

File Name: redhat-RHSA-2003-176.nasl

Version: $Revision: 1.21 $

Type: local

Agent: unix

Published: 2004/07/06

Modified: 2016/12/28

Dependencies: 12634

Risk Information

Risk Factor: Critical


Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:gnupg, cpe:/o:redhat:enterprise_linux:2.1

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Patch Publication Date: 2003/06/23

Vulnerability Publication Date: 2003/05/03

Reference Information

CVE: CVE-2003-0255

OSVDB: 4947

RHSA: 2003:176