Описание
Security update for gpg2
This update for gpg2 fixes the following security issue:
- CVE-2018-12020: GnuPG mishandled the original filename during decryption and verification actions, which allowed remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option (bsc#1096745)
Список пакетов
openSUSE Leap 42.3
gpg2-2.0.24-9.3.1
gpg2-lang-2.0.24-9.3.1
Ссылки
- E-Mail link for openSUSE-SU-2018:1724-1
- SUSE Security Ratings
Описание
mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.
Затронутые продукты
openSUSE Leap 42.3:gpg2-2.0.24-9.3.1
openSUSE Leap 42.3:gpg2-lang-2.0.24-9.3.1
Ссылки
- CVE-2018-12020
- SUSE Bug 1096745
- SUSE Bug 1101134