SUSE-SU-2022:3144-1 Security update for gpg2

This update for gpg2 fixes the following issues: - CVE-2022-34903: Fixed a potential signature forgery via injection into the status line when certain unusual conditions are met bsc1201225...

Amazon Linux AMI : gnupg2 (ALAS-2022-1630)

The version of gnupg2 installed on the remote host is prior to 2.0.28-2.35. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1630 advisory. A vulnerability was found in GnuPG. This issue occurs due to an escape detection loop at the writestatustextandbuffer function in...

OESA-2022-1847 gnupg2 security update

GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 also known as PGP. GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories. Security Fixes: GnuPG...

Amazon Linux 2 : gnupg2 (ALAS-2022-1834)

The version of gnupg2 installed on the remote host is prior to 2.0.22-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1834 advisory. A vulnerability was found in GnuPG. This issue occurs due to an escape detection loop at the writestatustextandbuffer function in...

USN-5526-2 pyjwt regression

USN-5526-1 fixed vulnerabilities in PyJWT. Unfortunately this caused a regression by incrementing the internal package version number on Ubuntu 22.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Aapo Oksman discovered that PyJWT incorrectly...

SUSE SLED15 / SLES15 Security Update : gpg2 (SUSE-SU-2022:2546-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:2546-1 advisory. - GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's...

SUSE SLES12 Security Update : gpg2 (SUSE-SU-2022:2529-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:2529-1 advisory. - GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other...

CLSA-2022-1657815972 Fix CVE(s): CVE-2022-34903

SECURITY UPDATE: signature forgery via injection into the status line - debian/patches/CVE-2022-34903.patch: Fix garbled status messages in NOTATIONDATA in g10/cpr.c. - CVE-2022-34903...

GnuPG through 2.3.6 in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g. use of GPGME) are met allows signature forgery via injection into the status line.

...

Mageia: Security Advisory (MGASA-2022-0259)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2022-0259 Updated gnupg2 packages fix security vulnerability

In unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints e.g., use of GPGME are met, allows signature forgery via injection into the status line. CVE-2022-34903...

Updated gnupg2 packages fix security vulnerability

In unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints e.g., use of GPGME are met, allows signature forgery via injection into the status line. CVE-2022-34903...

USN-5503-2: GnuPG vulnerability

USN-5503-1 fixed a vulnerability in GnuPG. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: Demi Marie Obenour discovered that GnuPG incorrectly handled injection in the status message. A remote attacker could possibly use this...

Ubuntu 16.04 ESM : GnuPG vulnerability (USN-5503-2)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5503-2 advisory. USN-5503-1 fixed a vulnerability in GnuPG. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Tenable has extracted the...

Slackware Linux 15.0 / current gnupg2 Vulnerability (SSA:2022-188-01)

The version of gnupg2 installed on the remote host is prior to 2.2.36. It is, therefore, affected by a vulnerability as referenced in the SSA:2022-188-01 advisory. - GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : GnuPG vulnerability (USN-5503-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5503-1 advisory. Demi Marie Obenour discovered that GnuPG incorrectly handled injection in the status message. A remote attacker could possibly use this...

Signature Forgery

gnupg2 is vulnerable to signature forgery. The vulnerability exists when an attacker possesses any secret-key information from a victim’s keyring and other constraints are met causing a forgery...

Debian DSA-5174-1 : gnupg2 - security update

The remote Debian 10 / 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5174 advisory. Demi Marie Obenour discovered a flaw in GnuPG, allowing for signature spoofing via arbitrary injection into the status line. An attacker who controls the secret part ...

ALPINE-CVE-2022-34903

GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints e.g., use of GPGME are met, allows signature forgery via injection into the status line...

CVE-2022-34903

GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints e.g., use of GPGME are met, allows signature forgery via injection into the status line...