[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAEg-Je_psmtK-f3jod46Q3q1DFx9McmdYBMpZjeKesRSsWdhBg@mail.gmail.com>
Date: Mon, 29 Dec 2025 05:46:14 -0500
From: Neal Gompa <ngompa13@...il.com>
To: oss-security@...ts.openwall.com
Cc: Sam James <sam@...too.org>
Subject: Re: Many vulnerabilities in GnuPG
On Sun, Dec 28, 2025 at 9:51 PM Demi Marie Obenour
<demiobenour@...il.com> wrote:
>
> On 12/28/25 05:00, Sam James wrote:
> > Demi Marie Obenour <demiobenour@...il.com> writes:
> >
> >> https://gpg.fail lists many vulnerabilities in GnuPG, one of which
> >> allows remote code execution.
> >
> >> All are zero-days to the best of my knowledge.
> >
> > In 2.5.14:
>
> Fedora isn't running 2.5.14 even in Rawhide. It's a zero-day for
> Fedora users at least.
>
> Upstream GnuPG is increasingly unwilling to collaborate with other
> OpenPGP implementations, and distros are having to patch GnuPG just to
> restore interoperability. If possible, it would be best for distros
> to either outright fork the project and create a new upstream, or stop
> packaging GnuPG entirely in favor of Sequoia's compatibility layer.
The Fedora Linux family of distributions already doesn't use GnuPG in
the critical path anymore. RPM and DNF have been switched to
SequoiaPGP for quite some time. That change was inherited by Red Hat
Enterprise Linux 10 as well.
This is why we have PQC support in our PGP stuff.
--
真実はいつも一つ！/ Always, there's only one truth!
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
