Bug 855395 (CVE-2022-34903) – <app-crypt/gnupg-{2.2.35-r1, 2.3.6-r1}: Signature spoofing via status line injection

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Sam James 2022-06-30 19:08:39 UTC]

Post on oss-security: https://marc.info/?l=oss-security&m=165657063921408&w=2

Partial quote:
"""
After discovering that gpgv does not support
--exit-on-status-write-error, I decided to check if it handles write
errors on the status file descriptor properly.  I ultimately found that
while such errors are *not* handled properly, exploiting this flaw in
practice would likely be very difficult and unreliable.  However, in the
course of this research (and entirely accidentally), I found that if a
signature has a notation with a value of 8192 spaces, gpg will crash
while writing the notation's value to the status FD.  This turned out to
be a far more severe flaw, with consequences including the ability to
make a signature that will appear to be ultimately valid and made by a
key with any fingerprint one wishes.
"""

[Comment 1 Larry the Git Cow 2022-06-30 20:01:14 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=988fa70ca5731f8d4a1862d559603cbf13d569be

commit 988fa70ca5731f8d4a1862d559603cbf13d569be
Author:     Sam James <[e-mail]>
AuthorDate: 2022-06-30 20:01:02 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2022-06-30 20:01:08 +0000

    app-crypt/gnupg: backport signature status message fix
    
    Bug: https://bugs.gentoo.org/855395
    Signed-off-by: Sam James <[e-mail]>

 .../gnupg-2.2.35-status-messages-garbled.patch     |  45 ++++++
 .../gnupg-2.3.6-status-messages-garbled.patch      |  45 ++++++
 app-crypt/gnupg/gnupg-2.2.35-r1.ebuild             | 160 ++++++++++++++++++++
 app-crypt/gnupg/gnupg-2.3.6-r1.ebuild              | 165 +++++++++++++++++++++
 4 files changed, 415 insertions(+)

[Comment 2 Larry the Git Cow 2022-07-12 01:28:39 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3070f3b4f2d5f3de77046e8594493fb041f86176

commit 3070f3b4f2d5f3de77046e8594493fb041f86176
Author:     Sam James <[e-mail]>
AuthorDate: 2022-07-12 01:27:32 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2022-07-12 01:27:59 +0000

    app-crypt/gnupg: add 2.3.7
    
    Note that CVE-2022-34903 was already fixed in 2.4.6-r1 in Gentoo.
    
    Bug: https://bugs.gentoo.org/855395
    Signed-off-by: Sam James <[e-mail]>

 app-crypt/gnupg/Manifest           |   2 +
 app-crypt/gnupg/gnupg-2.3.7.ebuild | 164 +++++++++++++++++++++++++++++++++++++
 2 files changed, 166 insertions(+)

[Comment 3 Larry the Git Cow 2024-08-10 08:41:31 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=edaa82dbe986586c12f7d0e15ccfaa2e8c17c4d2

commit edaa82dbe986586c12f7d0e15ccfaa2e8c17c4d2
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2024-08-10 08:41:19 +0000
Commit:     Hans de Graaff <[e-mail]>
CommitDate: 2024-08-10 08:41:29 +0000

    [ GLSA 202408-23 ] GnuPG: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/855395
    Bug: https://bugs.gentoo.org/923248
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: Hans de Graaff <[e-mail]>

 glsa-202408-23.xml | 43 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)