{"action":"Upgrade gnupg to 2.2.23-r0 or later.","affected":[{"fixed":"2.2.23-r0","introduced":"0"}],"component":"gnupg","cve_ids":[],"ecosystem":"Alpine","ecosystem_qualifier":"Alpine:v3.13","exploited":false,"fixed_versions":["2.2.23-r0"],"id":"tcs_01M5NCE60HTXHSJGFG0CEYZ8J2","modified_at":"2026-09-11T10:17:51.410849248Z","published_at":"2020-09-03T18:15:15.160Z","references":["https://osv.dev/vulnerability/ALPINE-CVE-2020-25125","https://security.alpinelinux.org/vuln/CVE-2020-25125"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"ALPINE-CVE-2020-25125#Alpine:v3.13/gnupg","url":"https://osv.dev/vulnerability/ALPINE-CVE-2020-25125"}],"summary":"GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker's OpenPGP key, and this key has AEAD pref"}