CVE-2003-0971

GnuPG (GPG) 1.0.2, and other versions up to 1.2.3, creates ElGamal type 20 (sign+encrypt) keys using the same key component for encryption as for signing, which allows attackers to determine the private key from a signature.

• ftp://patches.sgi.com/support/free/security/advisories/20040202-01-U.asc
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000798
• http://lists.gnupg.org/pipermail/gnupg-announce/2003q4/000276.htmlPatch, Vendor Advisory
• http://lists.gnupg.org/pipermail/gnupg-announce/2003q4/000277.htmlPatch
• http://marc.info/?l=bugtraq&m=106995769213221&w=2
• http://secunia.com/advisories/10304
• http://secunia.com/advisories/10349
• http://secunia.com/advisories/10399
• http://secunia.com/advisories/10400
• http://www.debian.org/security/2004/dsa-429
• http://www.kb.cert.org/vuls/id/940388US Government Resource
• http://www.mandriva.com/security/advisories?name=MDKSA-2003:109
• http://www.novell.com/linux/security/advisories/2003_048_gpg.html
• http://www.redhat.com/support/errata/RHSA-2003-390.html
• http://www.redhat.com/support/errata/RHSA-2003-395.html
• http://www.securityfocus.com/bid/9115Patch, Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10982
• ftp://patches.sgi.com/support/free/security/advisories/20040202-01-U.asc
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000798
• http://lists.gnupg.org/pipermail/gnupg-announce/2003q4/000276.htmlPatch, Vendor Advisory
• http://lists.gnupg.org/pipermail/gnupg-announce/2003q4/000277.htmlPatch
• http://marc.info/?l=bugtraq&m=106995769213221&w=2
• http://secunia.com/advisories/10304
• http://secunia.com/advisories/10349
• http://secunia.com/advisories/10399
• http://secunia.com/advisories/10400
• http://www.debian.org/security/2004/dsa-429
• http://www.kb.cert.org/vuls/id/940388US Government Resource
• http://www.mandriva.com/security/advisories?name=MDKSA-2003:109
• http://www.novell.com/linux/security/advisories/2003_048_gpg.html
• http://www.redhat.com/support/errata/RHSA-2003-390.html
• http://www.redhat.com/support/errata/RHSA-2003-395.html
• http://www.securityfocus.com/bid/9115Patch, Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10982

Published

Dec 15, 2003

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2003-0965Cross-site scripting (XSS) vulnerability in the admin CGI sc…
• CVE-2003-0966Buffer overflow in the frm command in elm 2.5.6 and earlier,…
• CVE-2003-0967rad_decode in FreeRADIUS 0.9.2 and earlier allows remote att…
• CVE-2003-0968Stack-based buffer overflow in SMB_Logon_Server of the rlm_s…
• CVE-2003-0969mpg321 0.2.10 allows remote attackers to overwrite memory an…
• CVE-2003-0970The Network Management Port on Sun Fire B1600 systems allows…
• CVE-2003-0972Integer signedness error in ansi.c for GNU screen 4.0.1 and …
• CVE-2003-0973Unknown vulnerability in mod_python 3.0.x before 3.0.4, and …
• CVE-2003-0974Applied Watch Command Center allows remote attackers to cond…
• CVE-2003-0975Apple Safari 1.0 through 1.1 on Mac OS X 10.3.1 and Mac OS X…
• CVE-2003-0976NFS Server (XNFS.NLM) for Novell NetWare 6.5 does not proper…
• CVE-2003-0977CVS server before 1.11.10 may allow attackers to cause the C…