Mandrake Linux Advisory: gnupg

Mandrake Linux Security Update Advisory

Problem Description:

A bug was discovered in GnuPG versions 1.2.1 and earlier. When
gpg evaluates trust values for different UIDs assigned to a key, it
would incorrectly associate the trust value of the UID with the
highest trust value with every other UID assigned to that key. This
prevents a warning message from being given when attempting to
encrypt to an invalid UID, but due to the bug, is accepted as
valid.

Patches have been applied for version 1.0.7 and all users are
encouraged to upgrade.

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0255

http://lists.gnupg.org/pipermail/gnupg-announce/2003q2/000268.html

Updated Packages:

Corporate Server 2.1:
1bfcc7589ddd74946cbaa7d2f6c7081f
corporate/2.1/RPMS/gnupg-1.0.7-3.1mdk.i586.rpm
38a397a657d6f264db9679f2ed002ed7
corporate/2.1/SRPMS/gnupg-1.0.7-3.1mdk.src.rpm

Mandrake Linux 8.2:
024e2dc599314591cee3334bd205039f
8.2/RPMS/gnupg-1.0.7-3.1mdk.i586.rpm
38a397a657d6f264db9679f2ed002ed7
8.2/SRPMS/gnupg-1.0.7-3.1mdk.src.rpm

Mandrake Linux 8.2/PPC:
3d74d4e08b065e36249c38033389d12e
ppc/8.2/RPMS/gnupg-1.0.7-3.1mdk.ppc.rpm
38a397a657d6f264db9679f2ed002ed7
ppc/8.2/SRPMS/gnupg-1.0.7-3.1mdk.src.rpm

Mandrake Linux 9.0:
1bfcc7589ddd74946cbaa7d2f6c7081f
9.0/RPMS/gnupg-1.0.7-3.1mdk.i586.rpm
38a397a657d6f264db9679f2ed002ed7
9.0/SRPMS/gnupg-1.0.7-3.1mdk.src.rpm

Mandrake Linux 9.1:
9d1b5490ff82a97b279ef9cb68b458db
9.1/RPMS/gnupg-1.2.2-1.1mdk.i586.rpm
d0e70c888b593188bb92828908d8be8e
9.1/SRPMS/gnupg-1.2.2-1.1mdk.src.rpm

Mandrake Linux 9.1/PPC:
e7e402899a26c4f02e5684df16e33b0e
ppc/9.1/RPMS/gnupg-1.2.2-1.1mdk.ppc.rpm
d0e70c888b593188bb92828908d8be8e
ppc/9.1/SRPMS/gnupg-1.2.2-1.1mdk.src.rpm

Multi Network Firewall 8.2:
024e2dc599314591cee3334bd205039f
mnf8.2/RPMS/gnupg-1.0.7-3.1mdk.i586.rpm
38a397a657d6f264db9679f2ed002ed7
mnf8.2/SRPMS/gnupg-1.0.7-3.1mdk.src.rpm

Bug IDs fixed (see https://qa.mandrakesoft.com for
more information):

To upgrade automatically, use MandrakeUpdate. The verification
of md5 checksums and GPG signatures is performed automatically for
you.

If you want to upgrade manually, download the updated package
from one of our FTP server mirrors and upgrade with “rpm -Fvh
*.rpm”. A list of FTP mirrors can be obtained from:

http://www.mandrakesecure.net/en/ftp.php

Please verify the update prior to upgrading to ensure the
integrity of the downloaded package. You can do this with the
command:

rpm –checksig <filename>

All packages are signed by MandrakeSoft for security. You can
obtain the GPG public key of the Mandrake Linux Security Team
from:

https://www.mandrakesecure.net/RPM-GPG-KEYS

Please be aware that sometimes it takes the mirrors a few hours
to update.

You can view other update advisories for Mandrake Linux at:

http://www.mandrakesecure.net/en/advisories/

MandrakeSoft has several security-related mailing list services
that anyone can subscribe to. Information on these lists can be
obtained by visiting:

http://www.mandrakesecure.net/en/mlist.php

If you want to report vulnerabilities, please contact

security_linux-mandrake.com

<security linux-mandrake.com>