CVE-2003-0971: GNU Privacy Guard

Medium severity, CVSS 5.0. EPSS: 3.6% chance of exploitation in the next 30 days.

GnuPG (GPG) 1.0.2, and other versions up to 1.2.3, creates ElGamal type 20 (sign+encrypt) keys using the same key component for encryption as for signing, which allows attackers to determine the private key from a signature.

Affected products

• GNU Privacy Guard: version 1.0.2 only; version 1.0.3 only; version 1.0.3b only; version 1.0.4 only; version 1.0.5 only; version 1.0.6 only; …

Published 2003-12-15. Last modified 2026-06-16.