Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found 1 articles for you...
91
security advisorygentoognupgGentoo GLSA-202408-23 Normal: GnuPG Signature Spoofing Advisory
Multiple vulnerabilities have been discovered in GnuPG, the worst of which could lead to signature spoofing.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202408-23 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: GnuPG: Multiple Vulnerabilities Date: August 10, 2024 Bugs: #855395, #923248 ID: 202408-23 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been discovered in GnuPG, the worst of which could lead to signature spoofing. Background ========== The GNU Privacy Guard, GnuPG, is a free replacement for the PGP suite of cryptographic software. Affected packages ================= Package Vulnerable Unaffected --------------- ------------ ------------ app-crypt/gnupg < 2.4.4 > = 2.4.4 Description =========== Multiple vulnerabilities have been discovered in GnuPG. Please review the CVE identifiers referenced below for details. Impact ====== Please review the referenced CVE identifiers for details. Workaround ========== There is no known workaround at this time. Resolution ========== All GnuPG users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =app-crypt/gnupg-2.4.4" References ========== [ 1 ] CVE-2022-34903 https://nvd.nist.gov/vuln/detail/CVE-2022-34903 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202408-23 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Aug 10, 2024
Gentoo
98
security advisorymoderateRed HatRed Hat Enterprise Linux 9: Fix for Moderate GnuPG2 Signature Spoofing
An update for gnupg2 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: gnupg2 security update Advisory ID: RHSA-2022:6602-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2022:6602 Issue date: 2022-09-20 CVE Names: CVE-2022-34903 ==================================================================== 1. Summary: An update for gnupg2 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux BaseOS (v. 9) - aarch64, ppc64le, s390x, x86_64 3. Description: The GNU Privacy Guard (GnuPG or GPG) is a tool for encrypting data and creating digital signatures, compliant with OpenPGP and S/MIME standards. Security Fix(es): * gpg: Signature spoofing via status line injection (CVE-2022-34903) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2102868 - CVE-2022-34903 gpg: Signature spoofing viastatus line injection 6. Package List: Red Hat Enterprise Linux AppStream (v. 9): aarch64: gnupg2-debuginfo-2.3.3-2.el9_0.aarch64.rpm gnupg2-debugsource-2.3.3-2.el9_0.aarch64.rpm gnupg2-smime-2.3.3-2.el9_0.aarch64.rpm gnupg2-smime-debuginfo-2.3.3-2.el9_0.aarch64.rpm ppc64le: gnupg2-debuginfo-2.3.3-2.el9_0.ppc64le.rpm gnupg2-debugsource-2.3.3-2.el9_0.ppc64le.rpm gnupg2-smime-2.3.3-2.el9_0.ppc64le.rpm gnupg2-smime-debuginfo-2.3.3-2.el9_0.ppc64le.rpm s390x: gnupg2-debuginfo-2.3.3-2.el9_0.s390x.rpm gnupg2-debugsource-2.3.3-2.el9_0.s390x.rpm gnupg2-smime-2.3.3-2.el9_0.s390x.rpm gnupg2-smime-debuginfo-2.3.3-2.el9_0.s390x.rpm x86_64: gnupg2-debuginfo-2.3.3-2.el9_0.x86_64.rpm gnupg2-debugsource-2.3.3-2.el9_0.x86_64.rpm gnupg2-smime-2.3.3-2.el9_0.x86_64.rpm gnupg2-smime-debuginfo-2.3.3-2.el9_0.x86_64.rpm Red Hat Enterprise Linux BaseOS (v. 9): Source: gnupg2-2.3.3-2.el9_0.src.rpm aarch64: gnupg2-2.3.3-2.el9_0.aarch64.rpm gnupg2-debuginfo-2.3.3-2.el9_0.aarch64.rpm gnupg2-debugsource-2.3.3-2.el9_0.aarch64.rpm gnupg2-smime-debuginfo-2.3.3-2.el9_0.aarch64.rpm ppc64le: gnupg2-2.3.3-2.el9_0.ppc64le.rpm gnupg2-debuginfo-2.3.3-2.el9_0.ppc64le.rpm gnupg2-debugsource-2.3.3-2.el9_0.ppc64le.rpm gnupg2-smime-debuginfo-2.3.3-2.el9_0.ppc64le.rpm s390x: gnupg2-2.3.3-2.el9_0.s390x.rpm gnupg2-debuginfo-2.3.3-2.el9_0.s390x.rpm gnupg2-debugsource-2.3.3-2.el9_0.s390x.rpm gnupg2-smime-debuginfo-2.3.3-2.el9_0.s390x.rpm x86_64: gnupg2-2.3.3-2.el9_0.x86_64.rpm gnupg2-debuginfo-2.3.3-2.el9_0.x86_64.rpm gnupg2-debugsource-2.3.3-2.el9_0.x86_64.rpm gnupg2-smime-debuginfo-2.3.3-2.el9_0.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2022-34903 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2022 RedHat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYypfX9zjgjWX9erEAQiOvhAAhVRPZMa292T4ShXZAj/q0CrQorvNe2nQ yvOLbVmhP1hoGNczgXjCCaO8j72n2ZW4jDW1Y+iTIwdthKUWBp8+OjAJOeVjUuex 8BWX36sbIND6cNaRPhdayAaMt23nTkOqEKOHZQiAVkGdZefRQm0NCEnutsaGxc4f 9zg90wOrO3NCpIY5BbSqoa/yRPShL9c/myjeqngmaeviuDY435+cH+mRJtHiIEee RJld/ltoOoGwJSMiNr4fXLoFuPAYlSKvKYf4NPehRve3ykdgm492NIZgtSFcZs5I XkjmMJGqNHP6Q0a5+3Z89j1sFZR8uXH+sV0ZpW7RsdRqnzZULuXjBIv/8d3sZywM mxruNtaYOsmIh8uUzvkd2c/2gUKjKv9pO2o/Au4nq6dE1axWy1WLEvTUztk5sZ8N d0/y4t904ABz6u5aYADoObmCyULEkjY75FAcyzl6Zvayw9/SJH52pOPgYLzqR8Tu wOOgVdFtQju+5/ASzpuVnN6AjxcrBsTvEKOBI8zHTqlzaq6QpaZlO8etdcc2TXHV eVdSzlBbt0aZuqxhJD+y0N4N9/Oapq2JFjyaF6pac8wrcRrX8/j5FoOQPE/P4OOI qBGwF5WhU53uRoXYEMGT4GrgQfyuQypCbUUjTSkxcI4bidX3U2e5iT0cg4Kjv7qK tqtXxkGaWqc=ep9h -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Sep 20, 2022
Red Hat
98
security advisorysecurity issueRed Hat Enterprise LinuxRed Hat Enterprise Linux 8 RHSA-2022-6463 moderate: gpg signature spoofing
An update for gnupg2 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: gnupg2 security update Advisory ID: RHSA-2022:6463-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2022:6463 Issue date: 2022-09-13 CVE Names: CVE-2022-34903 ==================================================================== 1. Summary: An update for gnupg2 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64 3. Description: The GNU Privacy Guard (GnuPG or GPG) is a tool for encrypting data and creating digital signatures, compliant with OpenPGP and S/MIME standards. Security Fix(es): * gpg: Signature spoofing via status line injection (CVE-2022-34903) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2102868 - CVE-2022-34903 gpg: Signature spoofing via status line injection 6. Package List: Red Hat Enterprise Linux BaseOS (v.8): Source: gnupg2-2.2.20-3.el8_6.src.rpm aarch64: gnupg2-2.2.20-3.el8_6.aarch64.rpm gnupg2-debuginfo-2.2.20-3.el8_6.aarch64.rpm gnupg2-debugsource-2.2.20-3.el8_6.aarch64.rpm gnupg2-smime-2.2.20-3.el8_6.aarch64.rpm gnupg2-smime-debuginfo-2.2.20-3.el8_6.aarch64.rpm ppc64le: gnupg2-2.2.20-3.el8_6.ppc64le.rpm gnupg2-debuginfo-2.2.20-3.el8_6.ppc64le.rpm gnupg2-debugsource-2.2.20-3.el8_6.ppc64le.rpm gnupg2-smime-2.2.20-3.el8_6.ppc64le.rpm gnupg2-smime-debuginfo-2.2.20-3.el8_6.ppc64le.rpm s390x: gnupg2-2.2.20-3.el8_6.s390x.rpm gnupg2-debuginfo-2.2.20-3.el8_6.s390x.rpm gnupg2-debugsource-2.2.20-3.el8_6.s390x.rpm gnupg2-smime-2.2.20-3.el8_6.s390x.rpm gnupg2-smime-debuginfo-2.2.20-3.el8_6.s390x.rpm x86_64: gnupg2-2.2.20-3.el8_6.x86_64.rpm gnupg2-debuginfo-2.2.20-3.el8_6.x86_64.rpm gnupg2-debugsource-2.2.20-3.el8_6.x86_64.rpm gnupg2-smime-2.2.20-3.el8_6.x86_64.rpm gnupg2-smime-debuginfo-2.2.20-3.el8_6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2022-34903 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBYyCBytzjgjWX9erEAQhBhg/+KSNEvBY3M8glyU/at+t3haHSa0Ap6wtb y51Ua4fZ6rpA02TISCldKooeCOwvi5i66hwBT3ConquMSGm2RnKGOsifz7eWpl04 C+VcLu2R7w+egdw+smnzJmt4g/0SqIRFn/OTC8bIgM1bx4CzpZRqjlkWSUqiR6/T 8vf5yTClfwRc52Nt2lK1LNxX93AdPhI6rg9D9TgVt1nzshLDbRxIhoIgBKQyoeav YA0s8wtivise5QMH+occGIDBKk/fiiV/43dDRTnVpsrN7TzMOOMo2/9nSI7tdio4 +dNhuu41Ls0bi2kNNPa6IWePrs0lcscwp2IXY04y+XZH0seucWzsEYh7JbSUfvCQ tLjuRrWRtiSI3rc3G1FgRb56zqcikeareekYB7pOixxbjJM0JEoCe89w8ELA5S0R 7oW4EmMSgw9Xc7ytddqmK6aqit7JL3RZpSEAe2nY27+XsyVp8/P58mFz7/9cH0tF AdQFJfEMfHaWncTaY8m1LNS+03F72bsfZHwURuyKWOrwZa5CoM7pD20MSZuDNhJF TzJ/ZCJvyGkIiyLFl7tLWKLoXgsLi2iuyWKwP3QgCsoBYdx963BV5UVeslZjCvOp sWebkDhq5HJ9x4UKTkyT8RsI/q4BOFPflu4PwlGJEMQf1q7tMr0OZFKoD+Ku3JcH gnZufTP+0IE=AKN0 -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Sep 13, 2022
Red Hat
89
security advisorycriticalFedoraFedora 35: 0dbfb7e270 Critical Gnupg1 Signature Spoofing Fix
Security fix for CVE-2022-34903. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-0dbfb7e270 2022-07-28 01:29:59.622249 --------------------------------------------------------------------------------Name : gnupg1 Product : Fedora 35 Version : 1.4.23 Release : 18.fc35 URL : https://www.gnupg.org/ Summary : A GNU utility for secure communication and data storage Description : GnuPG (GNU Privacy Guard) is a GNU utility for encrypting data and creating digital signatures. GnuPG has advanced key management capabilities and is compliant with the proposed OpenPGP Internet standard described in RFC2440. Since GnuPG doesn't use any patented algorithm, it is not compatible with any version of PGP2 (PGP2.x uses only IDEA for symmetric-key encryption, which is patented worldwide). --------------------------------------------------------------------------------Update Information: Security fix for CVE-2022-34903 --------------------------------------------------------------------------------ChangeLog: * Tue Jul 19 2022 Brian C. Lane - 1.4.23-18 - g10/status.c: Backport fix for status buffer overrun Resolves: rhbz#2108445 - Note that this includes the fix for [CVE-2022-34903] * Thu Jan 20 2022 Fedora Release Engineering - 1.4.23-17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild --------------------------------------------------------------------------------References: [ 1 ] Bug #2102868 - CVE-2022-34903 gpg: Signature spoofing via status line injection https://bugzilla.redhat.com/show_bug.cgi?id=2102868 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-0dbfb7e270' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html Allpackages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Jul 27, 2022
•Critical
Fedora
89
security advisorygnupgcriticalFedora 36: 2022-1747eea46c Critical: GnuPG Signature Spoofing
Security fix for CVE-2022-34903. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-1747eea46c 2022-07-28 01:26:41.098904 --------------------------------------------------------------------------------Name : gnupg1 Product : Fedora 36 Version : 1.4.23 Release : 18.fc36 URL : http://www.gnupg.org/ Summary : A GNU utility for secure communication and data storage Description : GnuPG (GNU Privacy Guard) is a GNU utility for encrypting data and creating digital signatures. GnuPG has advanced key management capabilities and is compliant with the proposed OpenPGP Internet standard described in RFC2440. Since GnuPG doesn't use any patented algorithm, it is not compatible with any version of PGP2 (PGP2.x uses only IDEA for symmetric-key encryption, which is patented worldwide). --------------------------------------------------------------------------------Update Information: Security fix for CVE-2022-34903 --------------------------------------------------------------------------------ChangeLog: * Tue Jul 19 2022 Brian C. Lane - 1.4.23-18 - g10/status.c: Backport fix for status buffer overrun Resolves: rhbz#2108445 - Note that this includes the fix for [CVE-2022-34903] --------------------------------------------------------------------------------References: [ 1 ] Bug #2102868 - CVE-2022-34903 gpg: Signature spoofing via status line injection https://bugzilla.redhat.com/show_bug.cgi?id=2102868 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-1747eea46c' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Jul 27, 2022
•Critical
Fedora
87
security advisorysecurity issueDebianDebian: DSA-5174-1 Critical GnuPG2 Signature Spoofing Risk
Demi Marie Obenour discovered a flaw in GnuPG, allowing for signature spoofing via arbitrary injection into the status line. An attacker who controls the secret part of any signing-capable key or subkey in the victim's keyring, can take advantage of this flaw to provide a . - ------------------------------------------------------------------------- Debian Security Advisory DSA-5174-1
Jul 03, 2022
•Critical
Debian
89
security advisoryFedoraupdate informationFedora 28 Security Advisory: Evolution CVE-2018-15587 Moderate Threat
Security fix for CVE-2018-15587. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-fc866e9156 2019-03-08 21:40:10.944860 --------------------------------------------------------------------------------Name : evolution Product : Fedora 28 Version : 3.28.5 Release : 3.fc28 URL : https://wiki.gnome.org/Apps/Evolution Summary : Mail and calendar client for GNOME Description : Evolution is the GNOME mailer, calendar, contact manager and communications tool. The components which make up Evolution are tightly integrated with one another and act as a seamless personal information-management tool. --------------------------------------------------------------------------------Update Information: Security fix for CVE-2018-15587 --------------------------------------------------------------------------------ChangeLog: * Mon Feb 18 2019 Milan Crha - 3.28.5-3 - Add patch for RH bug #1677651 (CVE-2018-15587 reposition signature bar) * Fri Oct 26 2018 Milan Crha - 3.28.5-2 - Add BuildRequires/Requires for 'killall' binary * Mon Jul 30 2018 Milan Crha - 3.28.5-1 - Update to 3.28.5 * Mon Jul 16 2018 Milan Crha - 3.28.4-1 - Update to 3.28.4 * Mon Jun 18 2018 Milan Crha - 3.28.3-1 - Update to 3.28.3 * Mon May 7 2018 Milan Crha - 3.28.2-1 - Update to 3.28.2 --------------------------------------------------------------------------------References: [ 1 ] Bug #1677650 - CVE-2018-15587 evolution: specially crafted email leading to OpenPGP signatures being spoofed for arbitrary messages https://bugzilla.redhat.com/show_bug.cgi?id=1677650 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-fc866e9156' at the command line. For more information, refer to the dnf documentation availableat https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Mar 08, 2019
Fedora
172
security advisorycritical issuesoftware updateUbuntu 10.04 LTS USN-2028-1 Critical: libxml-security-java Spoofing Issue
Apache XML Security for Java could be tricked into validating spoofed signatures.. =========================================================================Ubuntu Security Notice USN-2028-1 November 12, 2013 libxml-security-java vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 10.04 LTS Summary: Apache XML Security for Java could be tricked into validating spoofed signatures. Software Description: - libxml-security-java: implementation of security standards for XML Details: James Forshaw discovered that Apache XML Security for Java incorrectly validated CanonicalizationMethod parameters. An attacker could use this flaw to spoof XML signatures. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 10.04 LTS: libxml-security-java 1.4.3-2ubuntu0.1 In general, a standard system update will make all the necessary changes. References: CVE-2013-2172 Package Information: https://launchpad.net/ubuntu/+source/libxml-security-java/1.4.3-2ubuntu0.1 . Apache XML Security for Java can enable fraudulent signature validation. It's crucial to upgrade Ubuntu 10.04 to address this severe vulnerability.. Apache XML Security, Signature Spoofing, Ubuntu Update. . Severity: Critical. LinuxSecurity.com Team
Nov 12, 2013
•Critical
Ubuntu
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!