[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <87bjj8pbu1.fsf_-_@jacob.g10code.de>
Date: Mon, 05 Jan 2026 11:56:22 +0100
From: Werner Koch <wk@...pg.org>
To: Jacob Bachmeyer <jcb62281@...il.com>
Cc: oss-security@...ts.openwall.com, Solar Designer <solar@...nwall.com>,
contact@....fail
Subject: GnuPG ticket T7900 (was: Many vulnerabilities in GnuPG)
Hi!
On Mon, 29 Dec 2025 10:51, Werner Koch said:
> https://dev.gnupg.org/T7900 which is the parent ticket for all these
Unfortunately this ticket and some other tickets where only accessible
by registered users or even more restricted. This is now fixed [1].
FWIW, here is a replyt which I posted on Mastodon:
Actually there is only one major bug (T7906 - armor parser) which was
fixed early November. T7901 requires a 2nd pre-image attack on SHA1 -
which does not yet exist. T7907 (plaintext recovery) is simply
untrue; see https://dev.gnupg.org/T7907#210501
BTW, of course we sign our commits and most of us even use hardware
tokens.
Shalom-Salam,
Werner
[1] Phabricator has a two-level permission system and in the web
interface only the first level is easy to see in the overview. Some
of us played it safe and restricted at both levels.
--
The pioneers of a warless world are the youth that
refuse military service. - A. Einstein
Download attachment "openpgp-digital-signature.asc" of type "application/pgp-signature" (285 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
