[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <5404BDC6.6060906@sumptuouscapital.com>
Date: Mon, 01 Sep 2014 20:41:10 +0200
From: Kristian Fiskerstrand <kristian.fiskerstrand@...ptuouscapital.com>
To: oss-security@...ts.openwall.com
CC: Werner Koch <wk@...pg.org>, pkg-gnupg-maint@...ts.alioth.debian.org
Subject: Re: gpg blindly imports keys from keyserver responses
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
On 09/01/2014 08:33 PM, Thijs Kinkhorst wrote:
> All,
Hi Thijs,
FYI your email results in a BAD signature for me, presumably due to
line-wrapping issue.
>
> All in all, the safe choice seems to be to patch this issue, so
> Debian will release updates for it. It has been fixed upstream in
> GnuPG 1.4.17 with this commit: http://git.gnupg.org/cgi-
> bin/gitweb.cgi?p=gnupg.git;a=commit;h=5230304349490f31aa64ee2b69a8a2bc06bf7816
>
>
>
Please note that this patch alone is not sufficient to fix the issue
as it brought usability issues fixed in later versions. Specifically
the first patch blocked retrieval of multiple keys at once, e.g during
a --refresh operation, and retrieval by subkey signing ID.
> I'll leave it to the numbering authorities whether this is
> something that should get a CVE id.
My personal opinion is this is expected behavior as the keyservers are
not trusted, and as you point out above, there are proper measures
that should be used that invalidate this as an attack vector, i.e. by
performing proper key verification.
- --
- ----------------------------
Kristian Fiskerstrand
Blog: http://blog.sumptuouscapital.com
Twitter: @krifisk
- ----------------------------
Public OpenPGP key 0xE3EDFAE3 at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3
- ----------------------------
"History is a gallery of pictures in which there are few originals and
many copies."
(Alexis de Tocqueville)
-----BEGIN PGP SIGNATURE-----
iQIcBAEBCgAGBQJUBL3FAAoJEPw7F94F4TageFQP/jCgcMKfRKVRo4crPCJLot90
N4mwGKOzausg07/TMjoZ689NJ6cIBINHT/BqKzggMzhCTOyphV/L44Hp6UIaiYx8
6DVtnd5JatTytAFJnua7G3r4dVHztGfGg29WipF/pPfE3THTYfCdWuluq151hP/9
csDgeKP1jg8l0AckNd+uFUzrkSs6AIqJH1IWHvsIOSuXS4jrmNoJgXfO+F0QJNd0
3Or1F+T7lF0kUql0ctxFADHvOy3Dj522IcQbprIFijlbeWvdIzYHquTMg6k/9FyE
f3HKiyLwti6FT68NVWYuTrvumQ4SelyxWm0Dzhe5ahOfgwI0NCN0I06InC2sFvrQ
Udl5HkMC9tBr16NXGmKI4OYvSu+FX8XmfM7z47me4uSUrgvwbuxAaPsiXTf782WD
/qCAzlF+b1Tf3DKbt1PjIxT9scfS+2OfJnFVw4zFf04SVhg5fjLg20pU7G5kgMKL
N+CWG4BcJef1u09NMJkEUo/28jSj6d8pVJPAiBhG6woi5SPlmTN/pC6DReYH0ZqQ
eQXDYorcOzB2KCFQVfY84A0JMnoQEqeDT4CdVuprlJyGb3Ued2yYFbKHoQnLOKEU
6IZyjzNsQ8uTyHbYBoZPZESuptdiI8jhSmXl1qEtv3Wy3uPnm/OL4DWeA5rGQ27n
fMpQUj7778mrO61EiHJJ
=fBqR
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
