CVE-2003-0971: GnuPG (GPG) 1.0.2, and other versions up to 1.2.3, creates ElGamal type 20 (sign+encrypt) keys using the sa...

Security readout for executives and security teams

This flaw affects very old GnuPG installations that generated ElGamal type 20 signing-and-encryption keys. A signature made with such a key can expose enough information for an attacker to determine the private key. That can undermine trust in signatures and encrypted data tied to those keys. Exposure is likely limited to legacy systems or archived key material using GnuPG versions up to 1.2.3 and ElGamal type 20 sign+encrypt keys. Modern deployments are unlikely to be exposed unless old keys remain trusted or operational. Treat as high priority for environments with old cryptographic infrastructure or long-lived signing keys. The main business risk is loss of trust in signatures, identity, and encrypted records tied to affected keys, not broad network compromise. Mitigation focus: Identify any GnuPG installations at or below version 1.2.3.; Locate ElGamal type 20 sign+encrypt keys still trusted or used.; Follow vendor advisories for corrected GnuPG packages and guidance..

Prepared

Jun 30, 2026, 07:58 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.