gnupg [resigned]

2006-12-07T14:03:33
ID SSA-2006-340-01B
Type slackware
Reporter Slackware Linux Project
Modified 2006-12-07T14:03:33

Description

Hello,

As many people have pointed out, the last advisory (SSA:2006-340-01) was not signed with the usual Slackware Security Team key (fingerprint 40102233). I did some reconfiguration on the box that does the distribution signing and it had some unintended side-effects. :-/ Several CHECKSUMS.md5.asc files were also signed with the wrong key.

The affected CHECKSUMS.md5 files have been resigned and uploaded, and this announcement has also been signed (and verified :-) using the usual primary Slackware signing key.

Also, it was noticed that the URL given to lists.gnupg.org was either incorrect or has changed since the advisory was issued. This error has also been corrected.

Sorry for any confusion.

Pat

Corrected advisory follows:

[slackware-security] gnupg (SSA:2006-340-01)

New gnupg packages are available for Slackware 9.0, 9.1, 10.0, 10.1, 10.2, and 11.0 to fix security issues.

More details about the issues may be found here: http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000246.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6235 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6169

Here are the details from the Slackware 11.0 ChangeLog:

patches/packages/gnupg-1.4.6-i486-1_slack11.0.tgz: Upgraded to gnupg-1.4.6. This release fixes a severe and exploitable bug in earlier versions of gnupg. All gnupg users should update to the new packages as soon as possible. For details, see the information concerning CVE-2006-6235 posted on lists.gnupg.org: http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000491.html The CVE entry for this issue may be found here: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6235 This update also addresses a more minor security issue possibly exploitable when GnuPG is used in interactive mode. For more information about that issue, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6169 ( Security fix )

Where to find the new packages:

HINT: Getting slow download speeds from ftp.slackware.com? Give slackware.osuosl.org a try. This is another primary FTP site for Slackware that can be considerably faster than downloading from ftp.slackware.com.

Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating additional FTP and rsync hosting to the Slackware project! :-)

Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you.

Updated package for Slackware 9.0: ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/gnupg-1.4.6-i386-1_slack9.0.tgz

Updated package for Slackware 9.1: ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/gnupg-1.4.6-i486-1_slack9.1.tgz

Updated package for Slackware 10.0: ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/gnupg-1.4.6-i486-1_slack10.0.tgz

Updated package for Slackware 10.1: ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/gnupg-1.4.6-i486-1_slack10.1.tgz

Updated package for Slackware 10.2: ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/gnupg-1.4.6-i486-1_slack10.2.tgz

Updated package for Slackware 11.0: ftp://ftp.slackware.com/pub/slackware/slackware-11.0/patches/packages/gnupg-1.4.6-i486-1_slack11.0.tgz

MD5 signatures:

Slackware 9.0 package: bc23c2e8fd1862a3749d7ea9478654e2 gnupg-1.4.6-i386-1_slack9.0.tgz

Slackware 9.1 package: 1ec4938e51b300f332696f76ce5476b5 gnupg-1.4.6-i486-1_slack9.1.tgz

Slackware 10.0 package: 8be8d0094be837dca5274c6ef17d0856 gnupg-1.4.6-i486-1_slack10.0.tgz

Slackware 10.1 package: bdaf8c564a758fb13faecc8f030a8f3c gnupg-1.4.6-i486-1_slack10.1.tgz

Slackware 10.2 package: 1c9e9f1364086ccdb204d50d0ee87df2 gnupg-1.4.6-i486-1_slack10.2.tgz

Slackware 11.0 package: 8f0cd5490e5a12bddc4be418c6806fa3 gnupg-1.4.6-i486-1_slack11.0.tgz

Installation instructions:

Upgrade the package as root: > upgradepkg gnupg-1.4.6-i486-1_slack11.0.tgz