Ubuntu 22.04 LTS: USN-5503-1 Critical GnuPG Forged Signature Threat

ubuntu

July 5, 2022

GnuPG could allow forged signatures.

Summary

GnuPG could allow forged signatures.

Software Description:

- gnupg2: GNU privacy guard - a free PGP replacement

Details:

Demi Marie Obenour discovered that GnuPG incorrectly handled injection in

the status message. A remote attacker could possibly use this issue to

forge signatures.

Topics Covered

security advisory gnupg critical remote attack ubuntu gpg forged signature

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS:
  gnupg                           2.2.27-3ubuntu2.1
  gnupg2                          2.2.27-3ubuntu2.1
  gpg                             2.2.27-3ubuntu2.1

Ubuntu 21.10:
  gnupg                           2.2.20-1ubuntu4.1
  gnupg2                          2.2.20-1ubuntu4.1
  gpg                             2.2.20-1ubuntu4.1

Ubuntu 20.04 LTS:
  gnupg                           2.2.19-3ubuntu2.2
  gnupg2                          2.2.19-3ubuntu2.2
  gpg                             2.2.19-3ubuntu2.2

Ubuntu 18.04 LTS:
  gnupg                           2.2.4-1ubuntu1.6
  gnupg2                          2.2.4-1ubuntu1.6
  gpg                             2.2.4-1ubuntu1.6

In general, a standard system update will make all the necessary changes.