USN-3964-1: python-gnupg vulnerabilities
02 May 2019
Several security issues were fixed in python-gnupg
- python-gnupg - Python wrapper for the GNU Privacy Guard
Marcus Brinkmann discovered that GnuPG before 2.2.8 improperly handled certain
command line parameters. A remote attacker could use this to spoof the output of
GnuPG and cause unsigned e-mail to appear signed.
It was discovered that python-gnupg incorrectly handled the GPG passphrase. A
remote attacker could send a specially crafted passphrase that would allow them
to control the output of encryption and decryption operations.
The problem can be corrected by updating your system to the following package versions:
In general, a standard system update will make all the necessary changes.