CVE-2020-25125

Name of the Vulnerable Software and Affected Versions GnuPG versions 2.2.21 through 2.2.22 Gpg4win version 3.1.12

Description The issue is caused by an array overflow in the g10/key-check.c file, leading to a crash or possibly unspecified other impact when a victim imports an attacker's OpenPGP key with AEAD preferences.

Recommendations For GnuPG versions 2.2.21 and 2.2.22, update to version 2.2.23 to resolve the issue. For Gpg4win version 3.1.12, update to a version that includes the fix for GnuPG, such as GnuPG 2.2.23. As a temporary workaround, consider avoiding the import of OpenPGP keys with AEAD preferences until the issue is resolved.