1. Forum
  2. Usenet
  3. LINUX.DEBIAN.ANNOUNCE.SEC

  • [SECURITY] [DSA 5174-1] gnupg2 security update

    From Salvatore Bonaccorso@21:1/5 to All on Sun Jul 3 22:00:01 2022
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA512

    - ------------------------------------------------------------------------- Debian Security Advisory DSA-5174-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso
    July 03, 2022 https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : gnupg2
    CVE ID : CVE-2022-34903
    Debian Bug : 1014157

    Demi Marie Obenour discovered a flaw in GnuPG, allowing for signature
    spoofing via arbitrary injection into the status line. An attacker who
    controls the secret part of any signing-capable key or subkey in the
    victim's keyring, can take advantage of this flaw to provide a
    correctly-formed signature that some software, including gpgme, will
    accept to have validity and signer fingerprint chosen from the attacker.

    For the oldstable distribution (buster), this problem has been fixed
    in version 2.2.12-1+deb10u2.

    For the stable distribution (bullseye), this problem has been fixed in
    version 2.2.27-2+deb11u2.

    We recommend that you upgrade your gnupg2 packages.

    For the detailed security status of gnupg2 please refer to its security
    tracker page at:
    https://security-tracker.debian.org/tracker/gnupg2

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org
    -----BEGIN PGP SIGNATURE-----

    iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmLB8/RfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0Qntw/9FCfDun9YLSAcUZQaJ6nfMkhNS8tOzRKkSxLE6x4jtkaauwq0yamMF8B1 RB3IVvdqwLXf/K4R1DZTKD2X2XMSpCXsJmYZmxr4legUBbu215e6MFNVuGw1y1u8 AQf+BLTON7pG0GFW8Lh05b9vENrX1/ygoVth2g8Zr6T0WF7eoHDcoRUOdWfWyNUs q9rv3T+snsdnw1HDD3X43r+F+s3kAFzk/IbmLhvFqmKTBLGFdPjG7FuMUq5DXcJv 4Ee8wEdCNtZXDCaXzIZs0z8jqpdfnfmnu6eSXU+YuWYNmDooFvolnbLYmulpnQVp rNTx3YJYC0oKHuQgQeMm+eN1GLWdlbvO7rGmRaCopyUy8/wIxRqGr9FHoX6na/53 0WzL9MaGP00A1O9+9ngjGHt6ayK29/qs21TTAACrFBEr5Md1w8CzpDcXz9J51CjY dhoLxhwO2fn+LQ1ftzbOEVZvRMPI0YEJC96YOH3X/UtOoRaWo6Z/LQ9uIA01ZtPR BKtkeq/GmGeYBS5fkFbE2Y9LmjtEQKntKnGp0n6YTIlpCCX7aWlPWEvuVvN5DKU5 goKOX2TsjuDbGmoAf948o78udM8chx7hF/tSrjmHyI4oUF9Ia7tmEFuAhL9lFQ/R Z0XarN/k03VBe7z11hfF2gXTA8KGS/3cyQ0ru48b/5m6pIAmY+E=
    =xHQz
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)