Bug 185111

Summary: CVE-2006-0049 Gnupg incorrect malformed message verification
Product: [Fedora] Fedora Reporter: Nalin Dahyabhai <nalin>
Component: gnupgAssignee: Nalin Dahyabhai <nalin>
Status: CLOSED RAWHIDE QA Contact: Mike McLean <mikem>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: source=vendorsec,reported=20060305,public=20060309,impact=moderate
Fixed In Version: 1.4.2.2-2 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2006-03-10 19:07:11 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 184557    
Bug Blocks:    

Description Nalin Dahyabhai 2006-03-10 18:51:19 UTC 
+++ This bug was initially created as a clone of Bug #184557 +++

Gnupg incorrect malformed message verification

Tavis Ormandy discovered that it is still possible to trick gnupg into
incorrectly verifying a signed message.

The patch is here:
ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.2.1-1.4.2.2.diff.bz2