In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of service (application crash).
Weakness
The product dereferences a pointer that it expects to be valid but is NULL.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gnupg | Gnupg | 2.5.13 (including) | 2.5.17 (excluding) |
| Gpg4win | Gpg4win | 5.0.0 (including) | 5.0.1 (excluding) |
| Gnupg2 | Ubuntu | upstream | * |