Nixpkgs security tracker

Untriaged

Permalink CVE-2026-57062

2.9 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

created 2 months ago Activity log

Created suggestion 2 months ago

CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through …

CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.

References

Affected products

GnuPG

=<2.5.20

Matching in nixpkgs

pkgs.gnupg

Modern release of the GNU Privacy Guard, a GPL OpenPGP implementation

nixos-unstable -
- nixos-unstable-small 2.4.9
nixos-26.05 -
- nixos-26.05-small 2.4.9

pkgs.gnupg1

Modern release of the GNU Privacy Guard, a GPL OpenPGP implementation with symbolic links for gpg and gpgv

nixos-unstable -
- nixos-unstable-small 2.4.9
nixos-26.05 -
- nixos-26.05-small 2.4.9

pkgs.gnupg24

Modern release of the GNU Privacy Guard, a GPL OpenPGP implementation

nixos-unstable -
- nixos-unstable-small 2.4.9
nixos-26.05 -
- nixos-26.05-small 2.4.9

pkgs.pam_gnupg

Unlock GnuPG keys on login

nixos-unstable -
- nixos-unstable-small 0.4
nixos-26.05 -
- nixos-26.05-small 0.4

pkgs.gnupg1compat

Modern release of the GNU Privacy Guard, a GPL OpenPGP implementation with symbolic links for gpg and gpgv

nixos-unstable -
- nixos-unstable-small 2.4.9
nixos-26.05 -
- nixos-26.05-small 2.4.9