CVE-2019-6690: Canonical Ubuntu Linux

High severity, CVSS 7.5. EPSS: 8.5% chance of exploitation in the next 30 days.

python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting the affect functionality component.

Affected products

• Canonical Ubuntu Linux: version 18.04 only; version 18.10 only; version 19.04 only
• Debian Debian Linux: version 8.0 only; version 9.0 only
• Opensuse Leap: version 15.0 only
• Python Python-Gnupg: version 0.4.3 only
• Suse Backports: affected versions not specified

Published 2019-03-21. Last modified 2026-06-17.