Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2018:1698-2

Опубликовано: 18 окт. 2018
Источник: suse-cvrf

Описание

Security update for gpg2

This update for gpg2 fixes the following security issue:

  • CVE-2018-12020: GnuPG mishandled the original filename during decryption and verification actions, which allowed remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the '--status-fd 2' option (bsc#1096745)

Список пакетов

SUSE Linux Enterprise Server 12 SP2-BCL
gpg2-2.0.24-9.3.1
gpg2-lang-2.0.24-9.3.1

Ссылки

Описание

mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.

Затронутые продукты
SUSE Linux Enterprise Server 12 SP2-BCL:gpg2-2.0.24-9.3.1
SUSE Linux Enterprise Server 12 SP2-BCL:gpg2-lang-2.0.24-9.3.1
Ссылки