ALAS-2013-236


Amazon Linux AMI Security Advisory: ALAS-2013-236
Advisory Release Date: 2014-09-16 21:46 Pacific
Severity: Medium

Issue Overview:

GnuPG 1.4.x, 2.0.x, and 2.1.x treats a key flags subpacket with all bits cleared (no usage permitted) as if it has all bits set (all usage permitted), which might allow remote attackers to bypass intended cryptographic protection mechanisms by leveraging the subkey.

The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.


Affected Packages:

gnupg


Issue Correction:
Run yum update gnupg to update your system.

New Packages:
i686:
    gnupg-1.4.15-1.21.amzn1.i686
    gnupg-debuginfo-1.4.15-1.21.amzn1.i686

src:
    gnupg-1.4.15-1.21.amzn1.src

x86_64:
    gnupg-1.4.15-1.21.amzn1.x86_64
    gnupg-debuginfo-1.4.15-1.21.amzn1.x86_64