Security bugs are reported here via bugzilla

[Ladislav Hagara <ladislav.hagara AT unob.cz>]

GnuPG does not detect injection of unsigned data
================================================
(released 2006-03-09, CVE-2006-0049)


Summary
=======

In the aftermath of the false positive signature verfication bug
(announced 2006-02-15) more thorough testing of the fix has been done
and another vulnerability has been detected.

This new problem affects the use of *gpg* for verification of
signatures which are _not_ detached signatures.  The problem also
affects verification of signatures embedded in encrypted messages;
i.e. standard use of gpg for mails.

To solve this problem, an update of the current stable version has
been released (see below).


Impact:
=======

Signature verification of non-detached signatures may give a positive
result but when extracting the signed data, this data may be prepended
or appended with extra data not covered by the signature.  Thus it is
possible for an attacker to take any signed message and inject extra
arbitrary data.

Detached signatures (a separate signature file) are not affected.

All versions of gnupg prior to 1.4.2.2 are affected.

Scripts and applications using gpg to verify the integrity of data are
affected. This includes applications using the GPGME library.

The GnuPG version 1.9.x is not affected unless the currently
deprecated gpg part has been enabled.


Solution:
=========

Update GnuPG as soon as possible to version 1.4.2.2.  There are no
fixes for older versions available.


For more info:
http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html


-----
All users should update gnupg to version 1.4.2.2:

# scribe update
# cast -c gnupg

or

# scribe update
# sorcery queue-security
# cast --queue


--
Ladislav Hagara