USN-3964-1: python-gnupg vulnerabilities
2 May 2019
Several security issues were fixed in python-gnupg
- python-gnupg - Python wrapper for the GNU Privacy Guard
Marcus Brinkmann discovered that GnuPG before 2.2.8 improperly handled certain
command line parameters. A remote attacker could use this to spoof the output of
GnuPG and cause unsigned e-mail to appear signed.
It was discovered that python-gnupg incorrectly handled the GPG passphrase. A
remote attacker could send a specially crafted passphrase that would allow them
to control the output of encryption and decryption operations.
The problem can be corrected by updating your system to the following package versions:
In general, a standard system update will make all the necessary changes.
- USN-3675-3: gnupg
- USN-3675-2: gpgv-udeb, gnupg2, dirmngr, gpgv2, gnupg-agent, scdaemon, gpgsm
- USN-3675-1: gnupg2, gnupg, gpgv2, gpgconf, gnupg-curl, gpgsm, gpg-wks-client, gnupg-utils, gpg-agent, gpgv-udeb, gnupg-agent, gnupg-udeb, scdaemon, gnupg-l10n, gpgv-static, dirmngr, gpg-wks-server, gpgv, gpg, gpgv-win32