Lucene search

K
mageiaGentoo FoundationMGASA-2013-0299
HistoryOct 10, 2013 - 2:34 a.m.

Updated gnupg2 packages fix multiple vulnerabilities

2013-10-1002:34:30
Gentoo Foundation
advisories.mageia.org
10

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.045 Low

EPSS

Percentile

92.4%

Updated gnupg2 package fixes security vulnerabilities: RFC 4880 permits OpenPGP keyholders to mark their primary keys and subkeys with a “key flags” packet that indicates the capabilities of the key. These are represented as a set of binary flags, including things like “This key may be used to encrypt communications.” If a key or subkey has this “key flags” subpacket attached with all bits cleared (off), GnuPG currently treats the key as having all bits set (on). While keys with this sort of marker are very rare in the wild, GnuPG’s misinterpretation of this subpacket could lead to a breach of confidentiality or a mistaken identity verification (CVE-2013-4351). Special crafted input data may be used to cause a denial of service against GPG. GPG can be forced to recursively parse certain parts of OpenPGP messages ad infinitum (CVE-2013-4402).

OSVersionArchitecturePackageVersionFilename
Mageia2noarchgnupg2< 2.0.18-1.4gnupg2-2.0.18-1.4.mga2
Mageia3noarchgnupg2< 2.0.19-3.2gnupg2-2.0.19-3.2.mga3

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.045 Low

EPSS

Percentile

92.4%