CVEs-PoC/2019/CVE-2019-13050.md

CVE-2019-13050

Description

Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.

POC

Reference

• https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/alphaSeclab/sec-daily-2019
• https://github.com/hannob/pgpbugs
• https://github.com/nedenwalker/spring-boot-app-using-gradle
• https://github.com/nedenwalker/spring-boot-app-with-log4j-vuln
• https://github.com/simonsdave/clair-cicd