UbuntuUpdates.org

Package "gnupg2"

Name: gnupg2

Description:

GNU privacy guard - a free PGP replacement (dummy transitional package)
Latest version: 2.4.4-2ubuntu18.2
Release: oracular (24.10)
Level: updates
Repository: universe
Homepage: https://www.gnupg.org/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "gnupg2"

All arch deb package
APT INSTALL

Other versions of "gnupg2" in Oracular

Repository Area Version
base universe 2.4.4-2ubuntu18
base main 2.4.4-2ubuntu18
security main 2.4.4-2ubuntu18.2
security universe 2.4.4-2ubuntu18.2
updates main 2.4.4-2ubuntu18.2

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 2.4.4-2ubuntu18.2 2025-04-03 18:07:16 UTC

  gnupg2 (2.4.4-2ubuntu18.2) oracular-security; urgency=medium

  * SECURITY UPDATE: verification DoS via crafted subkey data
    - debian/patches/CVE-2025-30258-1.patch: lookup key for merging/
      inserting only by primary key in g10/getkey.c, g10/import.c,
      g10/keydb.h.
    - debian/patches/CVE-2025-30258-2.patch: remove a signature check
      function wrapper in g10/mainproc.c, g10/packet.h, g10/sig-check.c.
    - debian/patches/CVE-2025-30258-3.patch: fix a verification DoS due to
      a malicious subkey in the keyring in g10/getkey.c, g10/gpg.h,
      g10/keydb.h, g10/mainproc.c, g10/packet.h, g10/sig-check.c.
    - debian/patches/CVE-2025-30258-4.patch: fix regression for the recent
      malicious subkey DoS fix in g10/getkey.c, g10/packet.h.
    - debian/patches/CVE-2025-30258-5.patch: fix double free of internal
      data in g10/sig-check.c.
    - CVE-2025-30258
  * debian/patches/fix-disable-exec-ftbfs.patch: updated to add
    get_max_fds() back in to fix FTBFS.

 -- Marc Deslauriers <email address hidden> Fri, 28 Mar 2025 11:23:49 -0400
CVE-2025-30258 In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect us


About   -   Send Feedback to @ubuntu_updates