Bug 184557

Summary:	CVE-2006-0049 Gnupg incorrect malformed message verification
Product:	[Fedora] Fedora	Reporter:	Josh Bressers <bressers>
Component:	gnupg	Assignee:	Nalin Dahyabhai <nalin>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Mike McLean <mikem>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	4	CC:	christof
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	source=vendorsec,reported=20060305,public=20060309,impact=moderate
Fixed In Version:	1.4.2.2-1	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-07-12 19:36:44 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	185111

Description Josh Bressers 2006-03-09 20:29:28 UTC

Gnupg incorrect malformed message verification

Tavis Ormandy discovered that it is still possible to trick gnupg into
incorrectly verifying a signed message.

The patch is here:
ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.2.1-1.4.2.2.diff.bz2

Comment 1 Fedora Update System 2006-03-14 04:44:10 UTC

From User-Agent: XML-RPC

gnupg-1.4.2.2-1 has been pushed for FC4, which should resolve this issue.  If these problems are still present in this version, then please make note of it in this bug report.

Comment 2 Nalin Dahyabhai 2006-07-12 19:36:44 UTC

Hmm, don't know why this didn't get closed.