USN-3964-1: python-gnupg vulnerabilities
02 May 2019
Several security issues were fixed in python-gnupg
- python-gnupg - Python wrapper for the GNU Privacy Guard
Marcus Brinkmann discovered that GnuPG before 2.2.8 improperly handled certain
command line parameters. A remote attacker could use this to spoof the output of
GnuPG and cause unsigned e-mail to appear signed.
It was discovered that python-gnupg incorrectly handled the GPG passphrase. A
remote attacker could send a specially crafted passphrase that would allow them
to control the output of encryption and decryption operations.
The problem can be corrected by updating your system to the following package versions:
In general, a standard system update will make all the necessary changes.
- USN-3675-1: gnupg-utils, gpgv-udeb, gnupg2, gpg-agent, gpgv-static, scdaemon, gpg-wks-server, gpgv2, gpgconf, gpg, gnupg-l10n, gnupg-udeb, gpgv-win32, gnupg-agent, gpgv, gnupg-curl, gpg-wks-client, gnupg, dirmngr, gpgsm
- USN-3675-2: gpgv-udeb, scdaemon, gpgv2, gnupg2, dirmngr, gnupg-agent, gpgsm
- USN-3675-3: gnupg