pjp
Administrator
Joined: 16 Apr 2002
Posts: 20588
|
 Posted: Fri May 16, 2003 2:55 pm Post subject: [gentoo-security] GLSA: gnupg (200305-04) |
 |
|
| Daniel Ahlberg wrote: | - - - ---------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200305-04
- - - ---------------------------------------------------------------------
PACKAGE : gnupg
SUMMARY : key validity bug
DATE : 2003-05-16 11:55 UTC
VERSIONS AFFECTED : <gnupg-1.2.2
FIXED VERSION : >=gnupg-1.2.2
CVE : CAN-2003-0255
- - - ---------------------------------------------------------------------
- From advisory:
"As part of the development of GnuPG 1.2.2, a bug was discovered in the
key validation code. This bug causes keys with more than one user ID
to give all user IDs on the key the amount of validity given to the
most-valid key."
Read the full advisory at
http://marc.theaimsgroup.com/?l=bugtraq&m=105215110111174&w=2
SOLUTION
It is recommended that all Gentoo Linux users who are running
app-crypt/gnupg upgrade to gnupg-1.2.2 as follows:
emerge sync
emerge gnupg
emerge clean
- - - ---------------------------------------------------------------------
aliz@gentoo.org - GnuPG key is available at http://cvs.gentoo.org/~aliz
- - - --------------------------------------------------------------------- |
Mailing List Archive: Unavailable
_________________
Quis separabit? Quo animo? |
|
News & Announcements
