USN-5503-1: GnuPG vulnerability

Releases

• Ubuntu 22.04 LTS
• Ubuntu 21.10
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM

Packages

• gnupg2 - GNU privacy guard - a free PGP replacement

Details

Demi Marie Obenour discovered that GnuPG incorrectly handled injection in
the status message. A remote attacker could possibly use this issue to
forge signatures.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 22.04

• gnupg - 2.2.27-3ubuntu2.1
• gpg - 2.2.27-3ubuntu2.1
• gnupg2 - 2.2.27-3ubuntu2.1

Ubuntu 21.10

• gnupg - 2.2.20-1ubuntu4.1
• gpg - 2.2.20-1ubuntu4.1
• gnupg2 - 2.2.20-1ubuntu4.1

Ubuntu 20.04

• gnupg - 2.2.19-3ubuntu2.2
• gpg - 2.2.19-3ubuntu2.2
• gnupg2 - 2.2.19-3ubuntu2.2

Ubuntu 18.04

• gnupg - 2.2.4-1ubuntu1.6
• gpg - 2.2.4-1ubuntu1.6
• gnupg2 - 2.2.4-1ubuntu1.6

In general, a standard system update will make all the necessary changes.

References

• CVE-2022-34903

Related notices

• USN-5503-2: gnupg2, gnupg, gpgv, gnupg-curl, dirmngr, gpgsm, scdaemon, gnupg-agent, gpgv2