oss-security - Re: Many vulnerabilities in GnuPG

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAH8yC8=+OjMZk4ZckBbicLK_q3GHCxRkZXJv_zCqSKa4D0Q-pA@mail.gmail.com>
Date: Sun, 28 Dec 2025 19:23:04 -0500
From: Jeffrey Walton <noloader@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Many vulnerabilities in GnuPG

On Sun, Dec 28, 2025 at 6:14 PM Sam James <sam@...too.org> wrote:
>
> [...]
> Finally, to end the dump of what I know so far: Werner Koch has
> published a response to the cleartext signature vulnerabilities:
> https://gnupg.org/blog/20251226-cleartext-signatures.html.

Also see dkg's post from 2014 at
<https://dkg.fifthhorseman.net/notes/inline-pgp-harmful/>.  From the
article:

    People often suggest that inline PGP signatures in e-mail are somehow
    more compatible or more acceptable than using PGP/MIME. This is a
    mistake. Inline PGP signatures are prone to several failure modes, up
    to and including undetectable message tampering.

Jeff

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.