CVE-2006-0455

Severity: medium (CVSS 4.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-02-15 · updated 2026-06-16

Description

gpgv in GnuPG before 1.4.2.1, when using unattended signature verification, returns a 0 exit code in certain cases even when the detached signature file does not carry a signature, which could cause programs that use gpgv to assume that the signature verification has succeeded. Note: this also occurs when running the equivalent command "gpg --verify".

Affected products

GNU Privacy Guard: 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.3b, 1.0.4 (+17)

References

http://fedoranews.org/updates/FEDORA-2006-116.shtml
http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000211.html
http://marc.info/?l=gnupg-devel&m=113999098729114&w=2
http://secunia.com/advisories/18845
http://secunia.com/advisories/18933
http://secunia.com/advisories/18934
http://secunia.com/advisories/18942
http://secunia.com/advisories/18955
http://secunia.com/advisories/18956
http://secunia.com/advisories/18968
http://secunia.com/advisories/19130

Get alerted when CVE-2006-0455 or the next vulnerability affects your stack