CVE-2018-9234 | BDVDB-2026-98917 Detail

Description#

GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://dev.gnupg.org/T3844
https://usn.ubuntu.com/3675-1/

Exploit#

No public exploit known

History#

Version 12018-04-04Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.