drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Zwei Probleme in GnuPG
Name: |
Zwei Probleme in GnuPG |
|
ID: |
USN-3675-1 |
|
Distribution: |
Ubuntu |
|
Plattformen: |
Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 17.10, Ubuntu 18.04 LTS |
|
Datum: |
Di, 12. Juni 2018, 07:36 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9234
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12020 |
|
Applikationen: |
The GNU Privacy Guard |
|
Originalnachricht |
--===============4489193978820368118== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="5xSkJheCpeK0RUEJ" Content-Disposition: inline
--5xSkJheCpeK0RUEJ Content-Type: text/plain; charset=us-ascii Content-Disposition: inline
========================================================================== Ubuntu Security Notice USN-3675-1 June 11, 2018
gnupg, gnupg2 vulnerabilities ==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS - Ubuntu 17.10 - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in GnuPG.
Software Description: - gnupg2: GNU privacy guard - a free PGP replacement - gnupg: GNU privacy guard - a free PGP replacement
Details:
Marcus Brinkmann discovered that during decryption or verification, GnuPG did not properly filter out terminal sequences when reporting the original filename. An attacker could use this to specially craft a file that would cause an application parsing GnuPG output to incorrectly interpret the status of the cryptographic operation reported by GnuPG. (CVE-2018-12020)
Lance Vick discovered that GnuPG did not enforce configurations where key certification required an offline master Certify key. An attacker with access to a signing subkey could generate certifications that appeared to be valid. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-9234)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 18.04 LTS: gnupg 2.2.4-1ubuntu1.1 gpg 2.2.4-1ubuntu1.1
Ubuntu 17.10: gnupg 2.1.15-1ubuntu8.1
Ubuntu 16.04 LTS: gnupg 1.4.20-1ubuntu3.2
Ubuntu 14.04 LTS: gnupg 1.4.16-1ubuntu2.5
In general, a standard system update will make all the necessary changes.
References: https://usn.ubuntu.com/usn/usn-3675-1 CVE-2018-12020, CVE-2018-9234
Package Information: https://launchpad.net/ubuntu/+source/gnupg2/2.2.4-1ubuntu1.1 https://launchpad.net/ubuntu/+source/gnupg2/2.1.15-1ubuntu8.1 https://launchpad.net/ubuntu/+source/gnupg/1.4.20-1ubuntu3.2 https://launchpad.net/ubuntu/+source/gnupg/1.4.16-1ubuntu2.5
--5xSkJheCpeK0RUEJ Content-Type: application/pgp-signature; name="signature.asc"
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEpgY7tWAjCaQ8jrvULwmejQBegfQFAlse+WcACgkQLwmejQBe gfTDRg/9EJnRL9CfXYO0TmrtnsI/+30l6gbUYa4i8y6GiHGlAiAwfm7z02gGvE5P OGmj+rjX/nF+6a6Nj64NbFbVYXPX3Ivq4ZYJVArkJExEfnvzkmgxFVqrfNgi7b61 5Nh3eKxhrRs5c4E8CPg27uL45FlcWiKw1M0yw9cawS9b53tay9d8wl0wOfItSxRE lgNEhMX5bBSZpqpDPpQRR/DxrMcH1V3GVDCTBcocn6q3KanOOfCRPwLFZ0VajgyQ tIyHUBT6eQAUiF4y47wD5EXIR1Rh6Epmw4nkBJCjf7WpJfpTi+Tg/iFZt1DJpEkW MwnesXmGIzVvJMVNNTMsaZ21pQupGQ1Lo4BRQLrhKtNOqQduZjQa97GlMJ7WIRgq 28r5bAnJ9h+SgRN5bA2hwC5fn7+jOoyxSpW1506nTDUWnSr28qC6Ss/vv2hbmP4p 0F7ZIC6k2yV0zRFlJ0XDEvTeNLaxjeL568nYu0E5Iuqq6EXWvNt+qyXTXi+c/Eqz h4S/WvuZHiqxAT97Q3gA39XLhoZzplrJIUld9THng+f42NXSs7o2nggL9E4Qz208 q0+vJqgeVspGa+yFopeEh+DipT4PLD9n3569mZWy5JbPjE6WUA96s5IfWooACh22 FLMqgY2c25LxakzbVmcq1rxxzE4kfLMlpkJU2pKR4wJll1Pc6QM= =zcVV -----END PGP SIGNATURE-----
--5xSkJheCpeK0RUEJ--
--===============4489193978820368118== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline
-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
|
|
|
|