Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Security Vulnerabilities 
cisa kev vulnerability prioritization
cisa kev vulnerability prioritization Most Linux teams don't struggle to find vulnerabilities anymore. They struggle to decide which ones deserve attention first. Between daily scanner results, vendor advisories, and hundreds of new CVEs each month, the challenge isn't visibility—it's prioritization. . To solve this, organizations typically lean on the National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities Catalog. But these aren’t competing lists. They answer two entirely different questions. While the...
Jul 22, 2026
Desktop Securitysecurity advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 3 articles for you...
210
security advisorygnupgcriticalGnuPG: Critical Remote Code Execution Threat Requires Immediate Patch
A serious flaw in the GnuPG crypto library can be pwned during decryption, potentially resulting in Remote Code Execution (RCE). Patch now! . Bug hunter Tavis Ormandy of Google’s Project Zero just discovered a dangerous bug in the GNU Privacy Guard team’s libgcrypt encryption software. The libgcrypt library is an open-source toolkit that anyone can use, but it’s probably best known as the encryption library used by the GNU Privacy Guard team’s own widely deployed GnuPG software (that’s the package you are using when you run the command gpg or gpg2 ). . An alarming flaw found in OpenSSL's security framework may result in potential exploitation risks. Update immediately!. GnuPG, Remote Code Execution, Critical Threat, Libgcrypt, Encryption. . Brittany Day
Feb 01, 2021
•
Security Vulnerabilities
67
gnupgencryptionsecurityGnuPG Funding: New Opportunities And Challenges After Significant Support
For almost two decades, the open source GnuPG encryption project has teetered on the brink of insolvency. Now, following word of that plight, the lone developer keeping the project alive has received more than $135,000. Short for Gnu Privacy Guard, GnuPG or simply GPG was first conceived in 1997. It makes up the guts that run GpG4Win, GPG Tools, and Enigmail, encryption programs that run on Windows, Macs, and as a plugin for the Thunderbird e-mail program respectively. An open source version of Phil Zimmermann's PGP, GnuPG quickly surged in popularity. Because it was written by a German citizen outside the US, it wasn't subject to then-draconian US laws restricting the export of strong cryptography technologies. Former NSA whistleblower Edward Snowden relied on the program to evade monitoring as he carried out his massive leak of top-secret documents. Many journalists and security professionals also swear by it.. GnuPG, a free software cryptographic tool, secures fresh funding post-financial struggle, but faces emerging hurdles going forward.. GnuPG, Encryption Software, Open Source Project, GPG Tools, Security Standards. . LinuxSecurity.com Team
Feb 09, 2015
•
Cryptography
67
gnupgopen sourceencryption toolsGnuPG Extensions for Enhanced Digital Privacy in GNOME Environment
The GNU Privacy Guard (GnuPG) allows you to encrypt, decrypt, sign, and verify communications and data, as well as create and manage the keys needed for these tasks. It is a full, open source implementation of the OpenPGP Standard (RFC2440) and is integrated into many Linux applications ranging from clipboard applets to instant messaging clients. These applications make it easy to use GnuPG for digital security in the GNOME desktop environment. Most user's don't use any form of encryption when sending information over the Internet. Is the problem that it's not alway easy to use encryption? However, with theses GnuPG plugins user's can easily protect all their Internet traffic without touching the command line.. The link for this article located at is no longer available. . The link for this article located at is no longer available.. privacy, guard, (gnupg), allows, encrypt, decrypt, verify, communications. . LinuxSecurity.com Team
Sep 17, 2007
•
Cryptography
67
gnupgemail encryptionsecure communicationsAchieve Secure Communication With PGP And GnuPG In Linux
File and mail security is easy to achieve with the right tools. PGP has proven itself the leader, and GnuPG is the tool of choice in the Linux world. Anyone who has read this column a while knows I'm a bit obsessive about crypto. With the speed of modern or even old processors, there's no reason that there should be any cleartext transmissions on the Internet at all. . . .. File and mail security is easy to achieve with the right tools. PGP has proven itself the leader, and GnuPG is the tool of choice in the Linux world. Anyone who has read this column a while knows I'm a bit obsessive about crypto. With the speed of modern or even old processors, there's no reason that there should be any cleartext transmissions on the Internet at all. Over the next few articles, I'll cover PGP (Pretty Good Privacy) and the GnuPG (GNU Privacy Guard) implementation of it. The link for this article located at WebProNews - Brian Hatch is no longer available. . Data protection and communication safety are enhanced with S/MIME and OpenPGP, which are prominent utilities in the Unix landscape for encrypted messaging.. File Security, Email Encryption, GnuPG Tools, PGP Implementation. . LinuxSecurity.com Team
Apr 05, 2004
•
Cryptography
67
security advisorygnupgcriticalGnuPG: Key Compromise Advisory and Immediate Revocation Recommended
Phong Nguyen identified a severe bug in the way GnuPG creates and uses ElGamal keys for signing. This is a significant security failure which can lead to a compromise of almost all ElGamal keys used for signing. Note that this is a real world vulnerability which will reveal your private key within a few seconds.. . .. Phong Nguyen identified a severe bug in the way GnuPG creates and uses ElGamal keys for signing. This is a significant security failure which can lead to a compromise of almost all ElGamal keys used for signing. Note that this is a real world vulnerability which will reveal your private key within a few seconds. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 GnuPG's ElGamal signing keys compromised ========================================== Summary ======= Phong Nguyen identified a severe bug in the way GnuPG creates and uses ElGamal keys for signing. This is a significant security failure which can lead to a compromise of almost all ElGamal keys used for signing. Note that this is a real world vulnerability which will reveal your private key within a few seconds. Please *take immediate action and revoke your ElGamal signing keys*. Furthermore you should take whatever measures necessary to limit the damage done for signed or encrypted documents using that key. Please do not send private mail in response to this message as I won't have the time to catch up with all the messages. The mailing list gnupg-users at gnupg.org is the best place to discuss this problem (please subscribe first so you don't need moderator approval [2]). Note that the standard keys as generated by GnuPG (DSA and ElGamal encryption) as well as RSA keys are NOT vulnerable. Note also that ElGamal signing keys cannot be generated without the use of a special flag to enable hidden options and even then overriding a warning message about this key type. See below for details on how to identify vulnerable keys. This message is signed using the usual GnuPG distribution key[1]. I apologize forthis severe bug and all the problems resulting from it. Background: =========== For historic reasons [3], GnuPG permits creating ElGamal keys which are usable for both encryption and signing. It is even possible to have one key (the primary one) used for both operations. This is not considered good cryptographic practice, but is permitted by the OpenPGP standard. It was not anticipated that these keys would still be used for signing because they have several disadvantages: The signature is much larger than a RSA or DSA signature, verification and creation takes far longer and the use of ElGamal for signing has always been problematic due to a couple of cryptographic weaknesses when not done properly. Thus I have always dissuaded people from using ElGamal keys for signing; however they are still used and about 200 keys per year are generated and uploaded to the keyservers. In January 2000, as part of version 1.0.2, the GnuPG code was changed to create ElGamal keys which work more efficiently for encryption (selecting a smaller x secret exponent and using a smaller k for encryption). While making this change the problem with signing keys was accidentally introduced: the same small k for encryption was also used for signing. This can be used for a cryptographic attack to reveal the private key (i.e. the secret exponent x) if a signature made using that key is available. Such a signature is always available for primary ElGamal keys because signatures created with that key are used to bind the user ID and other material to the primary key (self-signatures). Even if the key was never used for signing documents it should be considered compromised. Note that this weakness does not apply to the far more common encrypt-only (type 16) ElGamal key as GnuPG does not permit signatures to be issued by this key type. Only the ElGamal sign+encrypt key (type 20) is affected and then only when used to make a signature with a GnuPG version 1.0.2 or later. Impact: ======= All ElGamal sign+encrypt keys (type 20)generated with GnuPG 1.0.2 or later must be considered compromised. Keys generated and used only with prior versions might still be safe but should ideally be revoked too. Note that even if an ElGamal sign+encrypt key was generated before GnuPG 1.0.2, using that key in GnuPG 1.0.2 or later to issue signatures will still compromise the key. Again, ElGamal encrypt-only keys (type 16) from any version of GnuPG are *not* affected. Solution: ========= Do not use *ElGamal sign+encrypt keys (type 20)*. Revoke all those keys immediately. Consider all material signed or encrypted with such a key as compromised. Forthcoming GnuPG versions will remove the ability to create such keys and the ability create ElGamal signatures. How to detect ElGamal type 20 keys: =================================== We have to distinguish between two cases: The primary key is ElGamal sign+encrypt versus just a subkey is ElGamal sign+encrypt. The first case requires immediate attention, like this one: $ gpg --list-keys xxxxxxxx pub 2048G/xxxxxxxx 2001-xx-xx Mallory such a key might be followed with additional "uid", "sig" or "sub" lines. Here an ElGamal sign+encrypt key is used and very likely created with GnuPG > = 1.0.2. The capital letter "G" indicates a ElGamal sign+encrypt key. REVOKE such a key immediately. The second case is about subkeys. Here is an example: $ gpg --list-keys 621CC013 pub 1024D/621CC013 1998-07-07 Werner Koch uid Werner Koch uid Werner Koch sub 1536g/ADF6A6E1 1999-02-20 [expires: 2002-11-01] sub 1536G/B5A18FF4 1998-07-07 [expires: 2002-07-06] sub 1536R/23D2A63D 2002-07-30 [expires: 2003-12-31] This my usual working key, which is a standard GnuPG key with some additional subkeys added over time. It is a good example because one subkey was created as type 20 signing and encrypt ElGamal key. It is the second subkey: sub 1536G/B5A18FF4 1998-07-07 [expires: 2002-07-06] The capital letter "G" denotes such anpossible compromised subkey whereas the first subkey: sub 1536g/ADF6A6E1 1999-02-20 [expires: 2002-11-01] is a standard encryption-only subkey as indicated by the small letter "g". That key is not affected. The keys denoted with this capital letter "G" should be REVOKED unless you are definitely sure those subkeys were never used to create a signatures with GnuPG > = 1.0.2. How to revoke a key: ==================== To create a revocation certificate for the entire key (primary and all subkeys), you do: gpg --gen-revoke your_keyid > foo.rev If you have lost access to your passphrase, hopefully you have a pre-manufactured revocation certificate (either on a floppy or printed on a sheet of paper) which you may the use instead of the above command. This revocation certificate should then be imported into GnuPG using: gpg --import mykey.asc gpg --keyserver subkeys.pgp.net --send-keys your_keyid If your primary key is not an ElGamal key, you might need to revoke a subkey. Note again that only type 20 ElGamal keys (denoted by a capital letter "G") require revocation - the standard ElGamal encrypt-only key (small g) is perfectly fine. Use gpg's edit command like this: $ gpg --edit-key xyzxyzxy The key listing will be shown. Select the subkey you want to revoke, using the command "key 2" (or whatever subkey it is) and then enter the command "revkey" and follow the prompts. Continue then with an export as described above. How many keys are affected? =========================== I can't tell for sure. According to the keyserver statistics, there are 848 primary ElGamal signing keys which are affected. These are a mere 0.04 percent of all primary keys on the keyservers. There are 324 vulnerable subkeys on the keyservers, too. Some of the subkeys might have never been used for signing because for some time in the past GnuPG created the encryption subkey as type 20 but didn't used it for signing because the DSA primary key was used instead. It is better to revoke such keysnevertheless. Note again that the standard configuration of GnuPG does not allow creating the vulnerable sign+encrypt ElGamal keys and that neither DSA (type 17), RSA (type 1) nor ElGamal encrypt-only keys (type 16) are affected. Thanks ====== Phong Nguyen [4] analyzed the implementation of GnuPG's cryptographic parts and found this vulnerability. He also developed actual code to mount the attack and was so kind to give me enough time to have a look at his paper and to gather a list of known type 20 keys owners. I am really sorry for this, Werner [1] To get a fresh key you might want to consult the keyservers or get it from using "finger wk at g10code.com" or "finger dd9jn at gnu.org". [2] See http://lists.gnupg.org/mailman/listinfo/gnupg-users . [3] The patent status of DSA was not clear when I started to write GnuPG back in 1997. [4] Working at the French National Center for Scientific Research and the Ecole normale superieure: https://www.di.ens.fr/~pnguyen/ . -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iD8DBQE/xavwaLeriVdUjc0RAquhAJ9crSJ2j8EbqaAnbJGoXBsgERPLaACePwcP 70laYWsyhXkzVgqL2X4ELVk= =xGWG -----END PGP SIGNATURE----- . An urgent alert has been raised by Phong Nguyen regarding a severe vulnerability in GnuPG that jeopardizes the integrity of ElGamal signing keys. Swift intervention is essential!. GnuPG Security, ElGamal Key Risk, Cryptographic Attack, Key Revocation. . LinuxSecurity.com Team
Nov 27, 2003
•
Cryptography
67
gnupgencryptionopen sourceGnuPG Introduction: Enhance Personal And Business Security
DesktopLinux.com guest author David Scribner has penned an article introducing new users to GnuPG on GNU/Linux (and UNIX) systems. Scribner focuses on how this powerful encryption package can play a vital role in personal and business communications by increasing security. This very detailed article will be available in two parts this week on DesktopLinux.com.. . .. DesktopLinux.com guest author David Scribner has penned an article introducing new users to GnuPG on GNU/Linux (and UNIX) systems. Scribner focuses on how this powerful encryption package can play a vital role in personal and business communications by increasing security. This very detailed article will be available in two parts this week on DesktopLinux.com. GNU Privacy Guard, or GnuPG (http://www.gnupg.org/), is the open-source equivalent of Philip Zimmermann's PGP (Pretty Good Privacy) encryption/authentication software released under GPL. Philip Zimmermann and others developed PGP in 1990 using the Rivest-Shamir-Adleman (RSA) public-key cryptosystem to answer the need for private and secure communications between individuals over digital medium. After its release to the public in 1991, it quickly grew to become the de facto standard worldwide for secure public-key encryption. The link for this article located at Desktop Linux is no longer available. . DesktopLinux.com guest author David Scribner has penned an article introducing new users to GnuPG on. desktoplinux, guest, author, david, scribner, penned, article, introducing, users, gnupg. . LinuxSecurity.com Team
Sep 23, 2002
•
Cryptography
67
security advisoryunauthorized accessgnupgGnuPG 1.0.5 Critical Advisory: Remote Code Execute Threat
Hidden deep within its code is a format string vulnerability which can be triggered simply by attempting to decrypt a file with a specially crafted filename. This vulnerability can allow a malicious user to gain unathorized access to the account which attempted the decryption.. . .. Hidden deep within its code is a format string vulnerability which can be triggered simply by attempting to decrypt a file with a specially crafted filename. This vulnerability can allow a malicious user to gain unathorized access to the account which attempted the decryption. Updated code is available from the GnuPG download site with vendor advisories following shortly. --------------------------------------------------------------------------- Remote arbitrary code execution vulnerability in GnuPG GnuPG is a complete and free replacement for PGP. Because it does not > use the patented IDEA algorithm, it can be used without any > restrictions. GnuPG is a RFC2440 (OpenPGP) compliant application. Hidden deep within its code is a format string vulnerability which can be triggered simply by attempting to decrypt a file with a specially crafted filename. This vulnerability can allow a malicious user to gain unathorized access to the account which attempted the decryption. --------------------------------------------------------------------------- [ Problem ] The problem code lies in util/ttyio.c in the 'do_get' function. There is a call to a function called 'tty_printf' (which eventually results in a vfprintf call) without a constant format string: > tty_printf( prompt ); If gpg attempts to decrypt a file whose filename does not end in ".gpg", that filename (minus the extension) is copied to the prompt string, allowing a user-suppliable format string. --------------------------------------------------------------------------- [ Solution ] The vulnerable call obviously needs the "%s" conversion: > tty_printf( "%s", prompt ); The newest release of GnuPG (version 1.0.6) contains this security fix, as well as implementing many new features. It can be obtained from https://www.gnupg.org/download/. All GnuPG users are strongly urged to upgrade as soon as possible. --------------------------------------------------------------------------- [ Exploit Discussion] In order to show the severity of the bug, look first at how it is reproduced. 1. Create a file with a valid format string as the filename. $ echo "hello, how are you friend?" > %8x_%8x_%8x 2. Encrypt this file. $ gpg -r
May 29, 2001
•
Cryptography
67
gnupgopen source softwareemail protectionGuide to Installing GnuPG for Secure Email Protection Steps
Here's a good article on installing and using GnuPG, the freely-available and patent-free PGP replacement that can be used to encrypt email and other sensitive information. . . .. Here's a good article on installing and using GnuPG, the freely-available and patent-free PGP replacement that can be used to encrypt email and other sensitive information. The link for this article located at LinuxNewbie.org is no longer available. . Discover how to set up OpenPGP, the open-source encryption software designed to protect your communications and confidential information with ease.. GnuPG Installation, Email Security, OpenPGP, Encryption Tools, Privacy Software. . LinuxSecurity.com Team
Mar 06, 2000
•
Cryptography
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!