Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <YsJ7JjZ/R/jqN+YX@itl-email>
Date: Mon, 4 Jul 2022 01:31:18 -0400
From: Demi Marie Obenour <demi@...isiblethingslab.com>
To: Open Source Software Security <oss-security@...ts.openwall.com>
Subject: Denial of service in GnuPG

GnuPG is vulnerable to a denial of service attack when processing
crafted detached signatures and/or certificates.  By concatenating the
same signature to itself a very large number of times, and then wrapping
them in a compressed packet, I am able to cause GnuPG to take over a
minute to process an input that is less than 5KB armored.

https://dev.gnupg.org/D556 should fix this particular bug by refusing to
process compressed packets in detached signatures and/or certificates.
There may be further problems with non-detached signatures that are not
addressed by D556, but I recommend applying D556 first.

Signature (of /dev/null) that triggers this bug is attached, along with
the corresponding public key.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab

Download attachment "test-key.cert" of type "application/octet-stream" (1209 bytes)

View attachment "decomp-3" of type "text/plain" (4604 bytes)

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.