| Summary: | <app-crypt/gnupg-2.2.19: WoT forgeries using SHA-1 (CVE-2019-14855) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Michael 'veremitz' Everitt <gentoo> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | minor | CC: | crypto+disabled, k_f |
| Priority: | Normal | Flags: | stable-bot:
sanity-check+
|
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://lists.gnupg.org/pipermail/gnupg-announce/2019q4/000442.html | ||
| Whiteboard: | A4 [noglsa cve] | ||
| Package list: |
app-crypt/gnupg-2.2.19
|
Runtime testing required: | --- |
|
Description
Michael 'veremitz' Everitt
2019-12-01 00:48:59 UTC
Yes, I've been waiting a bit on this to see if a quick fix is added for https://lists.gnupg.org/pipermail/gnupg-devel/2019-November/034487.html , but will likely bump it anyways later this week. The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5d39c36648f20fe75f0bbaf907bdc0b0bb48c7f5 commit 5d39c36648f20fe75f0bbaf907bdc0b0bb48c7f5 Author: Kristian Fiskerstrand <k_f@gentoo.org> AuthorDate: 2019-12-13 19:16:03 +0000 Commit: Kristian Fiskerstrand <k_f@gentoo.org> CommitDate: 2019-12-13 19:16:18 +0000 app-crypt/gnupg: New upstream version 2.2.19 Bug: https://bugs.gentoo.org/701616 Package-Manager: Portage-2.3.79, Repoman-2.3.16 Signed-off-by: Kristian Fiskerstrand <k_f@gentoo.org> app-crypt/gnupg/Manifest | 1 + app-crypt/gnupg/gnupg-2.2.19.ebuild | 152 ++++++++++++++++++++++++++++++++++++ 2 files changed, 153 insertions(+) @maintainer(s), ok to cleanup? (In reply to sam_c (Security Padawan) from comment #3) > @maintainer(s), ok to cleanup? Ignore me. The vulnerability is fixed in <2.2.19, so @maintainer(s), are we ok to stabilise or call yourself if appropriate? s390 stable sparc stable amd64 stable arm stable arm64 stable hppa stable ia64 stable ppc stable ppc64 stable x86 stable GLSA vote: no. (In reply to sam_c (Security Padawan) from comment #4) > The vulnerability is fixed in <2.2.19, so @maintainer(s), are we ok to > stabilise or call yourself if appropriate? This is meant to say 'fixed in 2.2.19. |
