USN-3964-1: python-gnupg vulnerabilities
2 May 2019
Several security issues were fixed in python-gnupg
- python-gnupg - Python wrapper for the GNU Privacy Guard
Marcus Brinkmann discovered that GnuPG before 2.2.8 improperly handled certain
command line parameters. A remote attacker could use this to spoof the output of
GnuPG and cause unsigned e-mail to appear signed.
It was discovered that python-gnupg incorrectly handled the GPG passphrase. A
remote attacker could send a specially crafted passphrase that would allow them
to control the output of encryption and decryption operations.
The problem can be corrected by updating your system to the following package versions:
In general, a standard system update will make all the necessary changes.
- USN-3675-3: gnupg
- USN-3675-2: gnupg-agent, gpgv-udeb, scdaemon, gnupg2, gpgv2, gpgsm, dirmngr
- USN-3675-1: gnupg-utils, gpgv-udeb, gpg, gpgsm, gpg-wks-client, gnupg-l10n, gnupg-agent, gnupg-curl, scdaemon, gpgv2, gpg-agent, gnupg-udeb, gpgv, gpgconf, dirmngr, gpgv-win32, gnupg2, gnupg, gpgv-static, gpg-wks-server
- USN-4839-1: python-gnupg, python3-gnupg