CVE-2001-0072

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2001-02-12 · updated 2026-06-16

Description

gpg (aka GnuPG) 1.0.4 and other versions imports both public and private keys from public key servers without notifying the user about the private keys, which could allow an attacker to break the web of trust.

Affected products

GNU Privacy Guard: 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.3b

References

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000368
http://www.debian.org/security/2000/20001225b
http://www.linux-mandrake.com/en/updates/2000/MDKSA-2000-087.php3
http://www.osvdb.org/1702
http://www.redhat.com/support/errata/RHSA-2000-131.html
http://www.securityfocus.com/archive/1/152197
http://www.securityfocus.com/bid/2153
https://exchange.xforce.ibmcloud.com/vulnerabilities/5803
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000368
http://www.debian.org/security/2000/20001225b
http://www.linux-mandrake.com/en/updates/2000/MDKSA-2000-087.php3
http://www.osvdb.org/1702

Get alerted when CVE-2001-0072 or the next vulnerability affects your stack