Red Hat 6.x and 7 Critical Advisory: GnuPG Key Import Issues

For each RPM for your particular architecture, run:

rpm -Fvh [filename]

where filename is the name of the RPM.

5. Bug IDs fixed ( for more info):

21889 - Web of trust circumvention by secret key distribution 21498 - Detached signature verification vulnerability

6. RPMs required:

Red Hat Linux 6.2:

SRPMS:

alpha:

i386:

sparc:

Red Hat Linux 7.0:

SRPMS:

alpha:

i386:

7. Verification:

MD5 sum Package Name aae767039effc37d4a929428e0d19543 6.2/alpha/gnupg-1.0.4-8.6.x.alpha.rpm 887b2d7d888fb8ee84c81cee7832384e 6.2/i386/gnupg-1.0.4-8.6.x.i386.rpm d7a3124166bc5c35cd3ca2dec36c97e0 6.2/sparc/gnupg-1.0.4-8.6.x.sparc.rpm 1f476ae8f5453655a4a61174de187d15 7.0/alpha/gnupg-1.0.4-9.alpha.rpm 88ac7d34da177b6c469e0f2a0f6117e6 7.0/i386/gnupg-1.0.4-9.i386.rpm 5e454eb08ce03f26eccbf7007026cd56 6.2/SRPMS/gnupg-1.0.4-8.6.x.src.rpm 4e81b35255980b0884e2f1ae3cf026d5 7.0/SRPMS/gnupg-1.0.4-9.src.rpm

These packages are GPG signed by Red Hat, Inc. for security. Our key is available at:

You can verify each package with the following command: rpm --checksig

If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: rpm --checksig --nogpg