USN-5503-1: GnuPG vulnerability
5 July 2022
GnuPG could allow forged signatures.
Releases
Packages
- gnupg2 - GNU privacy guard - a free PGP replacement
Details
Demi Marie Obenour discovered that GnuPG incorrectly handled injection in
the status message. A remote attacker could possibly use this issue to
forge signatures.
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 22.04
Ubuntu 21.10
Ubuntu 20.04
Ubuntu 18.04
In general, a standard system update will make all the necessary changes.
References
Related notices
- USN-5503-2: scdaemon, gnupg, dirmngr, gnupg-agent, gnupg2, gnupg-curl, gpgv, gpgsm, gpgv2