#121 fixed
steve

Release MacGPG 2.0.22

Reported by steve | October 5th, 2013 @ 11:55 AM

details from the gnupg mailing:

What's New in 2.0.22

  • Fixed possible infinite recursion in the compressed packet parser. [CVE-2013-4402]

  • Improved support for some card readers.

  • Prepared building with the forthcoming Libgcrypt 1.6.

  • Protect against rogue keyservers sending secret keys.

Impact of the security problem

Special crafted input data may be used to cause a denial of service
against GPG (GnuPG's OpenPGP part) and some other OpenPGP
implementations. All systems using GPG to process incoming data are
affected.

Taylor R. Campbell invented a neat trick to generate OpenPGP packages
to force GPG to recursively parse certain parts of OpenPGP messages ad
infinitum. As a workaround a tight "ulimit -v" setting may be used to
mitigate the problem. Sample input data to trigger this problem has
not yet been seen in the wild. Details of the attack will eventually
be published by its inventor.

A fixed release of the GnuPG 1.4 series has also been released.

An updated vesion of gpg4win will be released next week.

Getting the Software

Please follow the instructions found at http://www.gnupg.org/download/
or read on:

GnuPG 2.0.22 may be downloaded from one of the GnuPG mirror sites or
direct from ftp://ftp.gnupg.org/gcrypt/gnupg/ . The list of mirrors
can be found at http://www.gnupg.org/mirrors.html . Note, that GnuPG
is not available at ftp.gnu.org.

On the FTP server and its mirrors you should find the following files
in the gnupg/ directory:

gnupg-2.0.22.tar.bz2 (4200k) gnupg-2.0.22.tar.bz2.sig

 GnuPG source compressed using BZIP2 and OpenPGP signature.

gnupg-2.0.20-2.0.22.diff.bz2 (39k)

 A patch file to upgrade a 2.0.20 GnuPG source tree.  This patch
 does not include updates of the language files.

Comments and changes to this ticket

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.

New-ticket Create new ticket

Create your profile

Help contribute to this project by taking a few moments to create your personal profile. Create your profile ยป

Shared Ticket Bins

Pages