CVE ID:	CVE-2018-12020
Description:	mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.
Test IDs:	1.3.6.1.4.1.25623.1.0.704223   1.3.6.1.4.1.25623.1.0.852024   1.3.6.1.4.1.25623.1.1.2.2018.1223   1.3.6.1.4.1.25623.1.1.2.2019.1077   1.3.6.1.4.1.25623.1.0.874705   1.3.6.1.4.1.25623.1.1.4.2018.1814.1   1.3.6.1.4.1.25623.1.0.874700   1.3.6.1.4.1.25623.1.1.13.2018.170.01   1.3.6.1.4.1.25623.1.1.2.2018.1324   1.3.6.1.4.1.25623.1.1.2.2018.1333   1.3.6.1.4.1.25623.1.1.4.2018.1696.1   1.3.6.1.4.1.25623.1.1.10.2018.0292   1.3.6.1.4.1.25623.1.0.882922   1.3.6.1.4.1.25623.1.0.874775   1.3.6.1.4.1.25623.1.1.13.2018.159.01   1.3.6.1.4.1.25623.1.1.2.2019.1457   1.3.6.1.4.1.25623.1.1.4.2018.1698.1   1.3.6.1.4.1.25623.1.0.882921   1.3.6.1.4.1.25623.1.0.851792   1.3.6.1.4.1.25623.1.0.843562   1.3.6.1.4.1.25623.1.0.874682   1.3.6.1.4.1.25623.1.1.2.2018.1221   1.3.6.1.4.1.25623.1.0.874702   1.3.6.1.4.1.25623.1.0.851788   1.3.6.1.4.1.25623.1.0.892862   1.3.6.1.4.1.25623.1.1.12.2018.3675.3   1.3.6.1.4.1.25623.1.1.2.2019.1157   1.3.6.1.4.1.25623.1.1.4.2018.1698.2   1.3.6.1.4.1.25623.1.0.704222   1.3.6.1.4.1.25623.1.0.874703   1.3.6.1.4.1.25623.1.0.704224   1.3.6.1.4.1.25623.1.0.874711
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2018-12020 BugTraq ID: 104450 http://www.securityfocus.com/bid/104450 Debian Security Information: DSA-4222 (Google Search) https://www.debian.org/security/2018/dsa-4222 Debian Security Information: DSA-4223 (Google Search) https://www.debian.org/security/2018/dsa-4223 Debian Security Information: DSA-4224 (Google Search) https://www.debian.org/security/2018/dsa-4224 http://seclists.org/fulldisclosure/2019/Apr/38 http://openwall.com/lists/oss-security/2018/06/08/2 http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html https://dev.gnupg.org/T4012 https://github.com/RUB-NDS/Johnny-You-Are-Fired https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html https://lists.debian.org/debian-lts-announce/2021/12/msg00027.html http://www.openwall.com/lists/oss-security/2019/04/30/4 RedHat Security Advisories: RHSA-2018:2180 https://access.redhat.com/errata/RHSA-2018:2180 RedHat Security Advisories: RHSA-2018:2181 https://access.redhat.com/errata/RHSA-2018:2181 http://www.securitytracker.com/id/1041051 https://usn.ubuntu.com/3675-1/ https://usn.ubuntu.com/3675-2/ https://usn.ubuntu.com/3675-3/ https://usn.ubuntu.com/3964-1/