The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions.
References:GSA_kwCzR0hTQS01OXg0LTY3bWgtcHg1NM0s4Q
Crypt_GPG does not prevent additional options in GPG calls
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
| packagist:pear/crypt_gpg | < 1.6.7 | 1.6.7 | |
Affected Version RangesAll affected versions1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.6.0, 1.6.1, 1.6.2, 1.6.3, 1.6.4, 1.6.5, 1.6.6 All unaffected versions1.6.7, 1.6.8, 1.6.9, 1.6.10, 1.6.11 |
|||