Found two RFC compliance issues in PGPy 0.6.0 while doing differential fuzzing against GnuPG and RNP.
1. Overly lenient packet validation — 63.6% accept rate
PGPy's packet parser accepts a much wider range of malformed OpenPGP packets compared to GnuPG 2.2.27 and RNP 0.15.2. In differential testing, PGPy accepted 63.6% of test inputs that GnuPG and RNP both rejected.
This includes things like invalid packet versions, truncated subpackets, and malformed signature subpackets that other implementations correctly flag as errors.
The concern here is that if PGPy is used as part of a multi-layer validation pipeline (e.g., PGPy accepts → processed as valid, while a GnuPG-based downstream system would reject), it could lead to inconsistent security decisions.
2. Cannot parse standalone User ID packets
PGPy 0.6.0 cannot parse a standalone User ID packet (tag 13). When given a file containing only a User ID packet, PGPy fails with a parse error. GnuPG and RNP both handle this correctly.
Found through differential fuzzing (PathDiff project).
Found two RFC compliance issues in PGPy 0.6.0 while doing differential fuzzing against GnuPG and RNP.
1. Overly lenient packet validation — 63.6% accept rate
PGPy's packet parser accepts a much wider range of malformed OpenPGP packets compared to GnuPG 2.2.27 and RNP 0.15.2. In differential testing, PGPy accepted 63.6% of test inputs that GnuPG and RNP both rejected.
This includes things like invalid packet versions, truncated subpackets, and malformed signature subpackets that other implementations correctly flag as errors.
The concern here is that if PGPy is used as part of a multi-layer validation pipeline (e.g., PGPy accepts → processed as valid, while a GnuPG-based downstream system would reject), it could lead to inconsistent security decisions.
2. Cannot parse standalone User ID packets
PGPy 0.6.0 cannot parse a standalone User ID packet (tag 13). When given a file containing only a User ID packet, PGPy fails with a parse error. GnuPG and RNP both handle this correctly.
Found through differential fuzzing (PathDiff project).