What’s Vulnerable › Vulnerabilities

CVE-2018-9234

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-04-04 · updated 2026-06-17
• Weakness: CWE-320

Description

GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey.

Affected products

• Canonical Ubuntu Linux: 14.04, 16.04, 17.10, 18.04
• GnuPG: 2.2.4, 2.2.5

References

• https://dev.gnupg.org/T3844
• https://usn.ubuntu.com/3675-1/
• https://dev.gnupg.org/T3844
• https://usn.ubuntu.com/3675-1/

Get alerted when CVE-2018-9234 or the next vulnerability affects your stack