Skip to navigation

Security Advisory Important: gnupg security update

Advisory: RHSA-2007:0107-2
Type: Security Advisory
Severity: Important
Issued on: 2007-03-13
Last updated on: 2007-03-14
Affected Products: Red Hat Enterprise Linux (v. 5 server)
Red Hat Enterprise Linux Desktop (v. 5 client)
CVEs (cve.mitre.org): CVE-2007-1263

Details

Updated GnuPG packages that fix a security issue are now available for Red
Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

GnuPG is a utility for encrypting data and creating digital signatures.

Gerardo Richarte discovered that a number of applications that make use of
GnuPG are prone to a vulnerability involving incorrect verification of
signatures and encryption. An attacker could add arbitrary content to a
signed message in such a way that a receiver of the message would not be
able to distinguish between the properly signed parts of a message and the
forged, unsigned, parts. (CVE-2007-1263)

Whilst this is not a vulnerability in GnuPG itself, the GnuPG team have
produced a patch to protect against messages with multiple plaintext
packets. Users should update to these erratum packages which contain the
backported patch for this issue.

Red Hat would like to thank Core Security Technologies for reporting this
issue.


Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Updated packages

Red Hat Enterprise Linux (v. 5 server)

SRPMS:
gnupg-1.4.5-13.src.rpm
File outdated by:  RHSA-2014:0016
    MD5: 88df873d2b167bdfbb313f3a1ec2ea63
 
IA-32:
gnupg-1.4.5-13.i386.rpm
File outdated by:  RHSA-2014:0016
    MD5: 47649e57708dfae65f65af9cb619c00d
 
IA-64:
gnupg-1.4.5-13.ia64.rpm
File outdated by:  RHSA-2014:0016
    MD5: 264ad7041effae5b298835ce0ea670da
 
PPC:
gnupg-1.4.5-13.ppc.rpm
File outdated by:  RHSA-2014:0016
    MD5: 1a52050adf71e8b6aed8133e500569f4
 
s390x:
gnupg-1.4.5-13.s390x.rpm
File outdated by:  RHSA-2014:0016
    MD5: 589c91def49fc94470e62b705bc30d28
 
x86_64:
gnupg-1.4.5-13.x86_64.rpm
File outdated by:  RHSA-2014:0016
    MD5: d3954a6a0eb0f6a304b2e2ef50401927
 
Red Hat Enterprise Linux Desktop (v. 5 client)

SRPMS:
gnupg-1.4.5-13.src.rpm
File outdated by:  RHSA-2014:0016
    MD5: 88df873d2b167bdfbb313f3a1ec2ea63
 
IA-32:
gnupg-1.4.5-13.i386.rpm
File outdated by:  RHSA-2014:0016
    MD5: 47649e57708dfae65f65af9cb619c00d
 
x86_64:
gnupg-1.4.5-13.x86_64.rpm
File outdated by:  RHSA-2014:0016
    MD5: d3954a6a0eb0f6a304b2e2ef50401927
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

230467 - CVE-2007-1263 gnupg signed message spoofing


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/