[ GLSA 202008-21 ] Kleopatra

[GLSA]

Gentoo Linux Security Advisory

Title: Kleopatra: Remote code execution (GLSA 202008-21)
Severity: normal
Exploitable: local, remote
Date: 2020-08-30
Bug(s): #739556
ID: 202008-21

Synopsis

A vulnerability in Kleopatra allows arbitrary execution of code.

Background

Kleopatra is a certificate manager and a universal crypto GUI. It
supports managing X.509 and OpenPGP certificates in the GpgSM keybox and
retrieving certificates from LDAP servers.


Affected Packages

Package: kde-apps/kleopatra
Vulnerable: < 20.04.3-r1
Unaffected: >= 20.04.3-r1
Architectures: All supported architectures


Description

Kleopatra did not safely escape command line parameters provided by
URLs, which it configures itself to handle.


Impact

A remote attacker could entice a user to process a specially crafted URL
via openpgp4fpr handler, possibly resulting in execution of arbitrary
code with the privileges of the process, or cause a Denial of Service
condition.


Workaround

There is no known workaround at this time.

Resolution

All Kleopatra users should upgrade to the latest version: