--===============2420483162141656817==
Content-Type: multipart/signed; micalg="pgp-sha512";
	protocol="application/pgp-signature";
 boundary="=-nnLZDAH4Qh6FsGwurQtR"


--=-nnLZDAH4Qh6FsGwurQtR
Content-Type: text/plain; charset="UTF-8
Content-Transfer-Encoding: quoted-printable

==========================================================================
Ubuntu Security Notice USN-1570-1
September 17, 2012

gnupg, gnupg2 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
- Ubuntu 8.04 LTS

Summary:

GnuPG could be tricked into downloading a different key when downloading
from a key server.

Software Description:
- gnupg: GNU privacy guard - a free PGP replacement
- gnupg2: GNU privacy guard - a free PGP replacement

Details:

It was discovered that GnuPG used a short ID when downloading keys from a
keyserver, even if a long ID was requested. An attacker could possibly use
this to return a different key with a duplicate short key id.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  gnupg                           1.4.11-3ubuntu2.1
  gnupg2                          2.0.17-2ubuntu2.12.04.1

Ubuntu 11.10:
  gnupg                           1.4.11-3ubuntu1.11.10.1
  gnupg2                          2.0.17-2ubuntu2.11.10.1

Ubuntu 11.04:
  gnupg                           1.4.11-3ubuntu1.11.04.1
  gnupg2                          2.0.14-2ubuntu1.2

Ubuntu 10.04 LTS:
  gnupg                           1.4.10-2ubuntu1.1
  gnupg2                          2.0.14-1ubuntu1.4

Ubuntu 8.04 LTS:
  gnupg                           1.4.6-2ubuntu5.1
  gnupg2                          2.0.7-1ubuntu0.2

In general, a standard system update will make all the necessary changes.

References:
  http://www.ubuntu.com/usn/usn-1570-1
  https://launchpad.net/bugs/1016643

Package Information:
  https://launchpad.net/ubuntu/+source/gnupg/1.4.11-3ubuntu2.1
  https://launchpad.net/ubuntu/+source/gnupg2/2.0.17-2ubuntu2.12.04.1
  https://launchpad.net/ubuntu/+source/gnupg/1.4.11-3ubuntu1.11.10.1
  https://launchpad.net/ubuntu/+source/gnupg2/2.0.17-2ubuntu2.11.10.1
  https://launchpad.net/ubuntu/+source/gnupg/1.4.11-3ubuntu1.11.04.1
  https://launchpad.net/ubuntu/+source/gnupg2/2.0.14-2ubuntu1.2
  https://launchpad.net/ubuntu/+source/gnupg/1.4.10-2ubuntu1.1
  https://launchpad.net/ubuntu/+source/gnupg2/2.0.14-1ubuntu1.4
  https://launchpad.net/ubuntu/+source/gnupg/1.4.6-2ubuntu5.1
  https://launchpad.net/ubuntu/+source/gnupg2/2.0.7-1ubuntu0.2



--×nLZDAH4Qh6FsGwurQtR
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAABCgAGBQJQVzIiAAoJEGVp2FWnRL6TE+QP/AxQYnoXEp/a6WsnL3tzeFgX
s24AjhGEfYkXPijs+XHyf8fBkFwu04goYAw8Fq+byrURQZkOTyDQC0D36hh+hsiS
mj+bVD4RNkNZXyL+YJaChwC8fiX0R4aiZG7uUjszOiHAqKM7oSVJlFnxe2+8grg+
/37Nx2F37inVNcJhnJZQPCw+BQ3qcxXN9qqqrRcrTvOgvX73vz5cNpSHEu4JOiD8
uZqtvTTV5RQ/1SeAz+y+ZQbcPiIrHcQ0TU46r1mp+rbnVYschqY0YHHkv1JwcgUW
Hmnk4FXh3oJsd6BQjX+iYIaZ478bnyPQoqRvM8ILxaqzagR2EG6/7qCsX1X6m0Hs
Gx0pb0d+iJmnh8bnZsbiYO1tkbH81XNb9YrF1TdxprrzSOO8M/GTaat4d1OfduU2
aU2CU/7mKznEfHFcQkaXj+qC5shTmqm/66xgZJHssNhTKFDNIREojki0/UDGOVCG
RV7+/ZoC6/N7hi2Sv9XQw1RP45GcD7LbHhol7jFGnbwe3xgV0t+a86H63dhMQRPV
29Yz0dGhlUsgggxOu58b6ck3Pa0RflxcoWb3rHauIQY9R8CwVrvbbHdu35YOMWau
P5fbEr9NiWsMHiJKL/jeew8QJMSFPcEHy1vjHLWbR+vcmgNFK+H0V2z7Y4Hn60/9
iGsjHqXEfXkh1gD8GAC0
=aIOm
-----END PGP SIGNATURE-----

--=-nnLZDAH4Qh6FsGwurQtR--



--===============2420483162141656817==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

--===============2420483162141656817==--