gnupg security update

2007-03-0611:23:21

CentOS Project

lists.centos.org

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.274 Low

EPSS

Percentile

96.7%

JSON

CentOS Errata and Security Advisory CESA-2007:0106

GnuPG is a utility for encrypting data and creating digital signatures.

Gerardo Richarte discovered that a number of applications that make use of
GnuPG are prone to a vulnerability involving incorrect verification of
signatures and encryption. An attacker could add arbitrary content to a
signed message in such a way that a receiver of the message would not be
able to distinguish between the properly signed parts of a message and the
forged, unsigned, parts. (CVE-2007-1263)

Whilst this is not a vulnerability in GnuPG itself, the GnuPG team have
produced a patch to protect against messages with multiple plaintext
packets. Users should update to these erratum packages which contain the
backported patch for this issue.

Red Hat would like to thank Core Security Technologies for reporting this
issue.

Affected packages:
gnupg

Upstream details at:
https://access.redhat.com/errata/RHSA-2007:0106

OSVersionArchitecturePackageVersionFilename
CentOS3i386gnupg< 1.2.1-20gnupg-1.2.1-20.i386.rpm
CentOS3x86_64gnupg< 1.2.1-20gnupg-1.2.1-20.x86_64.rpm
CentOS3ia64gnupg< 1.2.1-20gnupg-1.2.1-20.ia64.rpm
CentOS3s390gnupg< 1.2.1-20gnupg-1.2.1-20.s390.rpm
CentOS3s390xgnupg< 1.2.1-20gnupg-1.2.1-20.s390x.rpm
CentOS4ia64gnupg< 1.2.6-9gnupg-1.2.6-9.ia64.rpm
CentOS4s390gnupg< 1.2.6-9gnupg-1.2.6-9.s390.rpm
CentOS4s390xgnupg< 1.2.6-9gnupg-1.2.6-9.s390x.rpm
CentOS4x86_64gnupg< 1.2.6-9gnupg-1.2.6-9.x86_64.rpm
CentOS4i386gnupg< 1.2.6-9gnupg-1.2.6-9.i386.rpm

OS	Version	Architecture	Package	Version	Filename
CentOS	3	i386	gnupg	< 1.2.1-20	gnupg-1.2.1-20.i386.rpm
CentOS	3	x86_64	gnupg	< 1.2.1-20	gnupg-1.2.1-20.x86_64.rpm
CentOS	3	ia64	gnupg	< 1.2.1-20	gnupg-1.2.1-20.ia64.rpm
CentOS	3	s390	gnupg	< 1.2.1-20	gnupg-1.2.1-20.s390.rpm
CentOS	3	s390x	gnupg	< 1.2.1-20	gnupg-1.2.1-20.s390x.rpm
CentOS	4	ia64	gnupg	< 1.2.6-9	gnupg-1.2.6-9.ia64.rpm
CentOS	4	s390	gnupg	< 1.2.6-9	gnupg-1.2.6-9.s390.rpm
CentOS	4	s390x	gnupg	< 1.2.6-9	gnupg-1.2.6-9.s390x.rpm
CentOS	4	x86_64	gnupg	< 1.2.6-9	gnupg-1.2.6-9.x86_64.rpm
CentOS	4	i386	gnupg	< 1.2.6-9	gnupg-1.2.6-9.i386.rpm