Executive Summary
| Summary | |
|---|---|
| Title | parcimonie security update |
| Informations | |||
|---|---|---|---|
| Name | DSA-2860 | First vendor Publication | 2014-02-11 |
| Vendor | Debian | Last vendor Modification | 2014-02-11 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Holger Levsen discovered that parcimonie, a privacy-friendly helper to refresh a GnuPG keyring, is affected by a design problem that undermines the usefulness of this piece of software in the intended threat model. When using parcimonie with a large keyring (1000 public keys or more), it would always sleep exactly ten minutes between two key fetches. This can probably be used by an adversary who can watch enough key fetches to correlate multiple key fetches with each other, which is what parcimonie aims at protecting against. Smaller keyrings are affected to a smaller degree. This problem is slightly mitigated when using a HKP(s) pool as the configured GnuPG keyserver. For the stable distribution (wheezy), this problem has been fixed in version 0.7.1-1+deb7u1. For the unstable distribution (sid), this problem has been fixed in version 0.8.1-1. We recommend that you upgrade your parcimonie packages. |
Original Source
| Url : http://www.debian.org/security/2014/dsa-2860 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-362 | Race Condition |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:22484 | |||
| Oval ID: | oval:org.mitre.oval:def:22484 | ||
| Title: | DSA-2860-1 parcimonie - information disclosure | ||
| Description: | Holger Levsen discovered that parcimonie, a privacy-friendly helper to refresh a GnuPG keyring, is affected by a design problem that undermines the usefulness of this piece of software in the intended threat model. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2860-1 CVE-2014-1921 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 7 Debian GNU/kFreeBSD 7 | Product(s): | parcimonie |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 3 |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-02-12 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2860.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-18 21:24:58 |
|
| 2014-02-17 11:32:34 |
|
| 2014-02-14 21:24:48 |
|
| 2014-02-12 00:18:25 |
|
