Signature Forgery in GnuPG by Status Line Injection

CVE-2022-34903

What is CVE-2022-34903?

Certain versions of GnuPG, specifically up to 2.3.6, are susceptible to a vulnerability that allows an attacker with access to secret-key information from a victim's keyring to perform signature forgery. This exploitation occurs under specific conditions, notably involving the use of GPGME. The flaw permits an attacker to inject malicious data into the status line, leading to deceptive signatures that can undermine the integrity of cryptographic operations and trust in signed communications.

References