Arch Linux Security Advisory ASA-201806-8 ========================================= Severity: High Date : 2018-06-11 CVE-ID : CVE-2018-12020 Package : gnupg Type : content spoofing Remote : Yes Link : https://security.archlinux.org/AVG-713 Summary ======= The package gnupg before version 2.2.8-1 is vulnerable to content spoofing. Resolution ========== Upgrade to 2.2.8-1. # pacman -Syu "gnupg>=2.2.8-1" The problem has been fixed upstream in version 2.2.8. Workaround ========== None. Description =========== A security issue has been found in gnupg before 2.2.8, leading to the possibility of faking verification status of signed content. The OpenPGP protocol allows to include the file name of the original input file into a signed or encrypted message. During decryption and verification the GPG tool can display a notice with that file name. The displayed file name is not sanitized and as such may include line feeds or other control characters. This can be used inject terminal control sequences into the out and, worse, to fake the so-called status messages. These status messages are parsed by programs to get information from gpg about the validity of a signature and an other parameters. Status messages are created with the option "--status-fd N" where N is a file descriptor. Now if N is 2 the status messages and the regular diagnostic messages share the stderr output channel. By using a made up file name in the message it is possible to fake status messages. Using this technique it is for example possible to fake the verification status of a signed mail. Impact ====== A remote attacker might be able to fake the verification status of a signed e-mail or file, via a crafted file name. References ========== https://bugs.archlinux.org/task/58931 https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html https://dev.gnupg.org/T4012 https://dev.gnupg.org/rG210e402acd3e284b32db1901e43bf1470e659e49 https://security.archlinux.org/CVE-2018-12020