1. Forum
  2. Usenet
  3. LINUX.GENTOO.ANNOUNCE

  • [gentoo-announce] [ GLSA 202408-23 ] GnuPG: Multiple Vulnerabilities

    From glsamaker@gentoo.org@21:1/5 to All on Sat Aug 10 10:50:02 2024
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Gentoo Linux Security Advisory GLSA 202408-23
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    https://security.gentoo.org/
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Severity: Normal
    Title: GnuPG: Multiple Vulnerabilities
    Date: August 10, 2024
    Bugs: #855395, #923248
    ID: 202408-23

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Synopsis
    ========

    Multiple vulnerabilities have been discovered in GnuPG, the worst of
    which could lead to signature spoofing.

    Background
    ==========

    The GNU Privacy Guard, GnuPG, is a free replacement for the PGP suite of cryptographic software.

    Affected packages
    =================

    Package Vulnerable Unaffected
    --------------- ------------ ------------
    app-crypt/gnupg < 2.4.4 >= 2.4.4

    Description
    ===========

    Multiple vulnerabilities have been discovered in GnuPG. Please review
    the CVE identifiers referenced below for details.

    Impact
    ======

    Please review the referenced CVE identifiers for details.

    Workaround
    ==========

    There is no known workaround at this time.

    Resolution
    ==========

    All GnuPG users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=app-crypt/gnupg-2.4.4"

    References
    ==========

    [ 1 ] CVE-2022-34903
    https://nvd.nist.gov/vuln/detail/CVE-2022-34903

    Availability
    ============

    This GLSA and any updates to it are available for viewing at
    the Gentoo Security Website:

    https://security.gentoo.org/glsa/202408-23

    Concerns?
    =========

    Security is a primary focus of Gentoo Linux and ensuring the
    confidentiality and security of our users' machines is of utmost
    importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

    License
    =======

    Copyright 2024 Gentoo Foundation, Inc; referenced text
    belongs to its owner(s).

    The contents of this document are licensed under the
    Creative Commons - Attribution / Share Alike license.

    https://creativecommons.org/licenses/by-sa/2.5
    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCgAdFiEEpqTA6ABLMxh/aChGFMQkOaVy+9kFAma3J8EACgkQFMQkOaVy +9nYKg/8D5NkCA4w+S7ZY3ul3YvkYC2zDfdjdDTWcW2bOkk9lLN28WvW9NbUVSXl foeq5tHVBe8ky3U22jVs/CBk7GtAJ+YQOs1d/yf41GroGtiwJ2Hnr+8IggR03p0J gSawJ3C2o7JvVYFlv+6xTOrPJa/WFWlV1jzL0eQsoikEIVVpjFNM92Uno82zlF3c JCViD+CMrMX5C5f7ybbTYv+ggTUUleSyHKV4srqzMpzkbeHhBIJa4iQhvdCgGVfQ 33/6MXYYTLhcXhFKpLWizT+gTHLrc9xsVgxt3FO+SzP92mvtvQPz4RoBYiI2rADF K0HS1OgqFPSq7N9/pEkIovEmtqbI6vo9YPBqBz52baZGS3/kwN00ctX9ESY6buzI KWvU9BdZ6aZ5rF5WKwAAuT0E1+fAKp5rWWzxXkjy6EALUt79BkMfLakPtJwflVoX OlktDeMQdbhjH4W77ygU6NJgGdWMtVqIPnUdylGXG3GUzS8AUNmM+7fP6T/PQupa o5JHiJcq4/qsb9f6lZ4JCVeFZYHsDuRr/+KM76YPBOISz5nRCv7wGxeFpiahEPXb fV7HPXvfwyVpgLzks4VM6ASaNOPR8OGSF5ZJ1NExq0tYdfB8IV5ptxyukzFE1KLc EPpFtLtKQx8/rtq0Tsm7aegub1PvhZw5EWNY+cVggcRDvWhjmOE=
    =DWMv
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)