[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <e689f7a6-3167-41ea-9ec0-88b87df4d68a@gmail.com>
Date: Sun, 28 Dec 2025 20:59:31 -0500
From: Demi Marie Obenour <demiobenour@...il.com>
To: oss-security@...ts.openwall.com, Sam James <sam@...too.org>
Subject: Re: Many vulnerabilities in GnuPG
On 12/28/25 05:00, Sam James wrote:
> Demi Marie Obenour <demiobenour@...il.com> writes:
>
>> https://gpg.fail lists many vulnerabilities in GnuPG, one of which
>> allows remote code execution.
>
>> All are zero-days to the best of my knowledge.
>
> In 2.5.14:
Fedora isn't running 2.5.14 even in Rawhide. It's a zero-day for
Fedora users at least.
Upstream GnuPG is increasingly unwilling to collaborate with other
OpenPGP implementations, and distros are having to patch GnuPG just to
restore interoperability. If possible, it would be best for distros
to either outright fork the project and create a new upstream, or stop
packaging GnuPG entirely in favor of Sequoia's compatibility layer.
--
Sincerely,
Demi Marie Obenour (she/her/hers)
Download attachment "OpenPGP_0xB288B55FFF9C22C1.asc" of type "application/pgp-keys" (7141 bytes)
Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
