{"id":"CVE-2018-1000858","details":"GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Disclosure, DoS. This attack appear to be exploitable via Victim must perform a WKD request, e.g. enter an email address in the composer window of Thunderbird/Enigmail. This vulnerability appears to have been fixed in after commit 4a4bb874f63741026bd26264c43bb32b1099f060.","modified":"2026-04-16T04:35:04.983587172Z","published":"2018-12-20T17:29:00.457Z","related":["SUSE-SU-2019:0023-1","openSUSE-SU-2019:0020-1"],"references":[{"type":"ADVISORY","url":"https://sektioneins.de/en/blog/18-11-23-gnupg-wkd.html"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/3853-1/"},{"type":"EVIDENCE","url":"https://sektioneins.de/en/advisories/advisory-012018-gnupg-wkd.html"}],"affected":[{"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1000858.json","unresolved_ranges":[{"events":[{"introduced":"2.1.12"},{"last_affected":"2.2.11"}]},{"events":[{"introduced":"0"},{"last_affected":"18.04"}]},{"events":[{"introduced":"0"},{"last_affected":"18.10"}]}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}