CVE-2003-0255

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2003-05-27 · updated 2026-06-16

Description

The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the greatest validity of the most valid user ID, which prevents GnuPG from warning the encrypting user when a user ID does not have a trusted path.

Affected products

GNU Privacy Guard: through 1.2.1

References

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000694
http://marc.info/?l=bugtraq&m=105215110111174&w=2
http://marc.info/?l=bugtraq&m=105301357425157&w=2
http://marc.info/?l=bugtraq&m=105311804129104&w=2
http://marc.info/?l=bugtraq&m=105362224514081&w=2
http://www.kb.cert.org/vuls/id/397604
http://www.linuxsecurity.com/advisories/engarde_advisory-3258.html
http://www.linuxsecurity.com/advisories/gentoo_advisory-3266.html
http://www.mandriva.com/security/advisories?name=MDKSA-2003:061
http://www.osvdb.org/4947
http://www.redhat.com/support/errata/RHSA-2003-175.html
http://www.redhat.com/support/errata/RHSA-2003-176.html

Get alerted when CVE-2003-0255 or the next vulnerability affects your stack