drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Zwei Probleme in gnupg
Name: |
Zwei Probleme in gnupg |
|
ID: |
MDVSA-2013:247 |
|
Distribution: |
Mandriva |
|
Plattformen: |
Mandriva Enterprise Server 5.0, Mandriva Business Server 1.0 |
|
Datum: |
Do, 10. Oktober 2013, 16:37 |
|
Referenzen: |
http://advisories.mageia.org/MGASA-2013-0299.html
http://advisories.mageia.org/MGASA-2013-0303.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4351
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4402
http://lists.gnu.org/archive/html/info-gnu/2013-10/msg00002.html
http://lists.gnu.org/archive/html/info-gnu/2013-10/msg00003.html |
|
Applikationen: |
The GNU Privacy Guard |
|
Originalnachricht |
This is a multi-part message in MIME format...
------------=_1381409480-2618-2
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2013:247 http://www.mandriva.com/en/support/security/ _______________________________________________________________________
Package : gnupg Date : October 10, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 _______________________________________________________________________
Problem Description:
Multiple vulnerabilities has been discovered and corrected in gnupg: GnuPG 1.4.x, 2.0.x, and 2.1.x treats a key flags subpacket with all bits cleared (no usage permitted) as if it has all bits set (all usage permitted), which might allow remote attackers to bypass intended cryptographic protection mechanisms by leveraging the subkey (CVE-2013-4351). Special crafted input data may be used to cause a denial of service against GPG. GPG can be forced to recursively parse certain parts of OpenPGP messages ad infinitum (CVE-2013-4402). The updated packages have been patched to correct this issue. _______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4351 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4402 http://advisories.mageia.org/MGASA-2013-0299.html http://advisories.mageia.org/MGASA-2013-0303.html http://lists.gnu.org/archive/html/info-gnu/2013-10/msg00002.html http://lists.gnu.org/archive/html/info-gnu/2013-10/msg00003.html _______________________________________________________________________
Updated Packages:
Mandriva Enterprise Server 5: fbd115f23ec4f6a05582ae80e49e7645 mes5/i586/gnupg-1.4.9-5.3mdvmes5.2.i586.rpm 6acd4c8754851b6538b65b0e47b0b713 mes5/i586/gnupg2-2.0.9-3.3mdvmes5.2.i586.rpm 241f14f857ac10bcdb27d85dada891dd mes5/SRPMS/gnupg-1.4.9-5.3mdvmes5.2.src.rpm 57f10f15a3dabba96af7a0056536613b mes5/SRPMS/gnupg2-2.0.9-3.3mdvmes5.2.src.rpm
Mandriva Enterprise Server 5/X86_64: 89b1885f005f3eaf6b0f9d11fb787554 mes5/x86_64/gnupg-1.4.9-5.3mdvmes5.2.x86_64.rpm e8066bcd0cfcab70000adc18598854f9 mes5/x86_64/gnupg2-2.0.9-3.3mdvmes5.2.x86_64.rpm 241f14f857ac10bcdb27d85dada891dd mes5/SRPMS/gnupg-1.4.9-5.3mdvmes5.2.src.rpm 57f10f15a3dabba96af7a0056536613b mes5/SRPMS/gnupg2-2.0.9-3.3mdvmes5.2.src.rpm
Mandriva Business Server 1/X86_64: 284ac6d2ad095ce979df482fa99d210a mbs1/x86_64/gnupg-1.4.12-3.2.mbs1.x86_64.rpm a118676f072c0a52988f2aeec6bf86af mbs1/x86_64/gnupg2-2.0.18-3.2.mbs1.x86_64.rpm 8e07611a9d7e2d7ab16d01a6a9d4090b mbs1/SRPMS/gnupg-1.4.12-3.2.mbs1.src.rpm db92e694092193f98dc2fd43fe6c3912 mbs1/SRPMS/gnupg2-2.0.18-3.2.mbs1.src.rpm _______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/en/support/security/advisories/
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com _______________________________________________________________________
Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux)
iD8DBQFSVnYCmqjQ0CJFipgRArb0AKDO1x51xpdkXHmgOiOxjw6ei5SLAACZAVJZ Dry2GuDwPgRZX3xGrxTWbFU= =s4km -----END PGP SIGNATURE-----
------------=_1381409480-2618-2 Content-Type: text/plain; charset="UTF-8"; name="message-footer.txt" Content-Disposition: inline; filename="message-footer.txt" Content-Transfer-Encoding: 8bit
To unsubscribe, send a email to sympa@mandrivalinux.org with this subject : unsubscribe security-announce _______________________________________________________ Want to buy your Pack or Services from Mandriva? Go to http://store.mandriva.com _______________________________________________________
------------=_1381409480-2618-2--
|
|
|
|