Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.1728.3
GnuPG vulnerabilities
19 June 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: gnupg
Publisher: Ubuntu
Operating System: Ubuntu
Impact/Access: Provide Misleading Information -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2018-12020 CVE-2018-9234
Reference: ESB-2018.1722
Original Bulletin:
http://www.ubuntu.com/usn/usn-3675-1
http://www.ubuntu.com/usn/usn-3675-2
http://www.ubuntu.com/usn/usn-3675-3
Comment: This bulletin contains three (3) Ubuntu security advisories.
Revision History: June 19 2018: Updated for gnugpg2 for Ubuntu 12.04 ESM
June 15 2018: Updated for gnugpg2 for 16.04 and 14.04
June 12 2018: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
==========================================================================
Ubuntu Security Notice USN-3675-1
June 11, 2018
gnupg, gnupg2 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- - Ubuntu 18.04 LTS
- - Ubuntu 17.10
- - Ubuntu 16.04 LTS
- - Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in GnuPG.
Software Description:
- - gnupg2: GNU privacy guard - a free PGP replacement
- - gnupg: GNU privacy guard - a free PGP replacement
Details:
Marcus Brinkmann discovered that during decryption or verification,
GnuPG did not properly filter out terminal sequences when reporting the
original filename. An attacker could use this to specially craft a file
that would cause an application parsing GnuPG output to incorrectly
interpret the status of the cryptographic operation reported by GnuPG.
(CVE-2018-12020)
Lance Vick discovered that GnuPG did not enforce configurations where
key certification required an offline master Certify key. An attacker
with access to a signing subkey could generate certifications that
appeared to be valid. This issue only affected Ubuntu 18.04 LTS.
(CVE-2018-9234)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
gnupg 2.2.4-1ubuntu1.1
gpg 2.2.4-1ubuntu1.1
Ubuntu 17.10:
gnupg 2.1.15-1ubuntu8.1
Ubuntu 16.04 LTS:
gnupg 1.4.20-1ubuntu3.2
Ubuntu 14.04 LTS:
gnupg 1.4.16-1ubuntu2.5
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/usn/usn-3675-1
CVE-2018-12020, CVE-2018-9234
Package Information:
https://launchpad.net/ubuntu/+source/gnupg2/2.2.4-1ubuntu1.1
https://launchpad.net/ubuntu/+source/gnupg2/2.1.15-1ubuntu8.1
https://launchpad.net/ubuntu/+source/gnupg/1.4.20-1ubuntu3.2
https://launchpad.net/ubuntu/+source/gnupg/1.4.16-1ubuntu2.5
- --------------------------------------------------------------------------
==========================================================================
Ubuntu Security Notice USN-3675-2
June 15, 2018
gnupg2 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- - Ubuntu 16.04 LTS
- - Ubuntu 14.04 LTS
Summary:
GnuPG 2 could be made to present validity information incorrectly.
Software Description:
- - gnupg2: GNU privacy guard - a free PGP replacement
Details:
USN-3675-1 fixed a vulnerability in GnuPG 2 for Ubuntu 18.04 LTS and
Ubuntu 17.10. This update provides the corresponding update for GnuPG 2
in Ubuntu 16.04 LTS and Ubuntu 14.04 LTS.
Original advisory details:
Marcus Brinkmann discovered that during decryption or verification,
GnuPG did not properly filter out terminal sequences when reporting the
original filename. An attacker could use this to specially craft a file
that would cause an application parsing GnuPG output to incorrectly
interpret the status of the cryptographic operation reported by GnuPG.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
gnupg2 2.1.11-6ubuntu2.1
Ubuntu 14.04 LTS:
gnupg2 2.0.22-3ubuntu1.4
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/usn/usn-3675-2
https://usn.ubuntu.com/usn/usn-3675-1
CVE-2018-12020
Package Information:
https://launchpad.net/ubuntu/+source/gnupg2/2.1.11-6ubuntu2.1
https://launchpad.net/ubuntu/+source/gnupg2/2.0.22-3ubuntu1.4
- --------------------------------------------------------------------------
==========================================================================
Ubuntu Security Notice USN-3675-3
June 18, 2018
gnupg vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- - Ubuntu 12.04 ESM
Summary:
GnuPG could be made to incorrectly interpret the status of the
cryptographic operation if it received specially crafted file.
Software Description:
- - gnupg: GNU privacy guard - a free PGP replacement
Details:
USN-3675-1 fixed a vulnerability in GnuPG. This update provides
the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
 Marcus Brinkmann discovered that during decryption or verification,
 GnuPG did not properly filter out terminal sequences when reporting
 the original filename. An attacker could use this to specially craft a
 file that would cause an application parsing GnuPG output to
 incorrectly interpret the status of the cryptographic operation
 reported by GnuPG. (CVE-2018-12020)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
 gnupg                           1.4.11-3ubuntu2.11
In general, a standard system update will make all the necessary
changes.
References:
 https://usn.ubuntu.com/usn/usn-3675-3
 https://usn.ubuntu.com/usn/usn-3675-1
 CVE-2018-12020
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWyhI62aOgq3Tt24GAQguvg//W0WmXZFWKbrm47FRxPW4MGGFH9fHnf63
AtGnk7Sp8W9bfPdLGJbc58jlmwIa7a2s9U0DmfyZkkI9C1e78cBKzCiEyBaQR5UO
xFN8HJPvkOMSgvgj7E7fkjwCyz04rR1Vl0cy5BV9amysjrkvaQdllCKXoYxrePS1
A+5OAxP+o58wsbQRMIKpe6M6ALeoFOmDdU/6lCUEAxcLW51U7kLl5krMoLWDNvEA
JAoxEKkTR5bGp7PioJu3fMREHgtlGfhtIlR9sFNac1c3gxhpqHMp77NK6X2ZnKcI
oSk6bCYL/CC4cYfbwz8ryadKEtS5d7IEcpPFjZu+00c/P5kojNijMoE8mIVFRhbj
ALtSa+10O/lTyz8/XyxTNlHcL7q80ev/5NIitixxj1q8MLtIZvOYtVdofWfPvHmA
u/Pj2FFvgcH6PUhDRh3KsT6cGteaLbSCdUbqTfnTnftBDTlUezUqZ70LGufq7KKz
SAHR9nbMQIb4kGBNaDcvqyHj5VeWFHFdaucmEl1l9KIM2RKSc9FcYXcwlrwrXSa6
YRWXyruBEIYdwproQGj5jR21+T3stdoJcPpK5uJRjzPQZVdkQdEd5GJoAYoFczfa
KC7D22/1rDZFdvbLjsaK4Iqf/d+KPXf29CAEMNdPHgm0pWZp5jBWOQ75GS5mYGa9
9wTwt/8rgnw=
=n2dN
-----END PGP SIGNATURE-----