gnupg: incorrect signature verification [LWN.net]

Package(s):

gnupg

CVE #(s):

CVE-2006-0049

Created:

March 13, 2006

Updated:

May 15, 2006

Description:

Another vulnerability has been found in GnuPG. "Signature verification of non-detached signatures may give a positive result but when extracting the signed data, this data may be prepended or appended with extra data not covered by the signature. Thus it is possible for an attacker to take any signed message and inject extra arbitrary data."

Alerts:

Fedora-Legacy	FLSA:185355	2006-05-12
Trustix	TSLSA-2006-0014	2006-03-20
Red Hat	RHSA-2006:0266-01	2006-03-15
Slackware	SSA:2006-072-02	2006-03-14
Fedora	FEDORA-2006-147	2006-03-13
Mandriva	MDKSA-2006:055	2006-03-13
Ubuntu	USN-264-1	2006-03-13
Debian	DSA-993-2	2006-03-13
Gentoo	200603-08	2006-03-10
Debian	DSA-993-1	2006-03-10

(Log in to post comments)