- Description
- PGP 5.5.x through 6.5.3 does not properly check if an Additional Decryption Key (ADK) is stored in the signed portion of a public certificate, which allows an attacker who can modify a victim's public certificate to decrypt any data that has been encrypted with the modified certificate.
- Source
- cve@mitre.org
- NVD status
- Modified
CVSS 2.0
- Type
- Primary
- Base score
- 5
- Impact score
- 2.9
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:P/I:N/A:N
- Hype score
- Not currently trending
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pgp:pgp:5.5.3i:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FC04D2F4-263E-4ED3-B22A-6AEEB3E03B16"
},
{
"criteria": "cpe:2.3:a:pgp:pgp:6.5.1i:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7FAE1A6C-DB2E-41BE-8497-2F71F79FB9B4"
},
{
"criteria": "cpe:2.3:a:pgp:pgp:6.5.3i:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "180A6E01-8D38-4938-BCC6-4A004A2A6BF8"
}
],
"operator": "OR"
}
]
}
]