Bug 2127010 (CVE-2022-3219)
|Summary:||CVE-2022-3219 gnupg: denial of service issue (resource consumption) using compressed packets|
|Product:||[Other] Security Response||Reporter:||Sandipan Roy <saroy>|
|Status:||NEW ---||QA Contact:|
|Version:||unspecified||CC:||bcl, crypto-team, jjelen, kyoshida, rdieter, tm|
|Fixed In Version:||Doc Type:||If docs needed, set a value|
A vulnerability was found in GnuPG. GnuPG can spin on a relatively small input by crafting a public key with thousands of signatures attached and compressed down to a few kilobytes. This issue can potentially cause a denial of service.
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Cloudforms Team:||---||Target Upstream Version:|
|Bug Depends On:||2127012, 2127013, 2127014, 2127015, 2127016|
Description Sandipan Roy 2022-09-15 05:01:02 UTC
GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB; see $URL and the surrounding email threads for more details and test-cases. The reporter has some proposed patches at https://dev.gnupg.org/D556 (and in oss-security / gnupg-devel threads); mostly these flag/reject compressed packets and indeterminate-length packets in contexts where they make no sense and arguably are not within the spec (certificates, keys, detached signatures).
Comment 1 Sandipan Roy 2022-09-15 05:22:12 UTC
Created gnupg1 tracking bugs for this issue: Affects: epel-all [bug 2127013] Affects: fedora-all [bug 2127014] Created gnupg2 tracking bugs for this issue: Affects: fedora-all [bug 2127015]
Comment 3 Jakub Jelen 2022-09-19 10:31:13 UTC
The upstream bug  with discussion from May (!) says the upstream is not going to implement/merge this change. From what I read on the oss-security , there is a reproducer and claims of DoS attacks. My reading is that this is not infinite recursion, but only slow processing of malformed inputs, which I consider low priority right now.  https://dev.gnupg.org/T5993  https://marc.info/?l=oss-security&m=165696590211434&w=4
Comment 4 Brian Lane 2022-09-19 15:36:27 UTC
(In reply to Jakub Jelen from comment #3) > The upstream bug  with discussion from May (!) says the upstream is not > going to implement/merge this change. From what I read on the oss-security > , there is a reproducer and claims of DoS attacks. My reading is that > this is not infinite recursion, but only slow processing of malformed > inputs, which I consider low priority right now. > >  https://dev.gnupg.org/T5993 >  https://marc.info/?l=oss-security&m=165696590211434&w=4 I agree. I am reluctant to backport things that upstream hasn't committed to fixing/changing and won't be doing anything for this on gpg1 until there is upstream consensus.