Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 1 Sep 2014 20:33:20 +0200
From: Thijs Kinkhorst <>
Cc: Werner Koch <>,
Subject: gpg blindly imports keys from keyserver responses


Stefan Tomanek reported to Debian that GnuPG accepts any key as a response 
from a keyserver, regardless of whether that key was actually requested:

There's some discussion about the issue; we believe that the primary way to 
verify key ownership is still the web of trust and manual fingerprint 
verification. It is however argued that as a user, requesting keys based on 
specifying the full fingerprint is a safe way to retreive a key for a known-
good fingerprint. But this argument is again somewhat countered by an attack 
on V3 keys which allows generating such fingerprints, making such a request 
dubious again.

All in all, the safe choice seems to be to patch this issue, so Debian will 
release updates for it. It has been fixed upstream in GnuPG 1.4.17 with this 

I'll leave it to the numbering authorities whether this is something that 
should get a CVE id.

Thijs Kinkhorst
Debian Security Team

Download attachment "signature.asc " of type "application/pgp-signature" (474 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.