Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 1 Sep 2014 20:33:20 +0200
From: Thijs Kinkhorst <thijs@...ian.org>
To: oss-security@...ts.openwall.com
Cc: Werner Koch <wk@...pg.org>, pkg-gnupg-maint@...ts.alioth.debian.org
Subject: gpg blindly imports keys from keyserver responses

All,

Stefan Tomanek reported to Debian that GnuPG accepts any key as a response 
from a keyserver, regardless of whether that key was actually requested:
https://bugs.debian.org/725411

There's some discussion about the issue; we believe that the primary way to 
verify key ownership is still the web of trust and manual fingerprint 
verification. It is however argued that as a user, requesting keys based on 
specifying the full fingerprint is a safe way to retreive a key for a known-
good fingerprint. But this argument is again somewhat countered by an attack 
on V3 keys which allows generating such fingerprints, making such a request 
dubious again.

All in all, the safe choice seems to be to patch this issue, so Debian will 
release updates for it. It has been fixed upstream in GnuPG 1.4.17 with this 
commit:
http://git.gnupg.org/cgi-
bin/gitweb.cgi?p=gnupg.git;a=commit;h=5230304349490f31aa64ee2b69a8a2bc06bf7816

I'll leave it to the numbering authorities whether this is something that 
should get a CVE id.


Cheers,
Thijs Kinkhorst
Debian Security Team

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ