mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.
{ "binaries": [ { "binary_version": "2.0.22-3ubuntu1.4", "binary_name": "gnupg-agent" }, { "binary_version": "2.0.22-3ubuntu1.4", "binary_name": "gnupg2" }, { "binary_version": "2.0.22-3ubuntu1.4", "binary_name": "gpgsm" }, { "binary_version": "2.0.22-3ubuntu1.4", "binary_name": "gpgv2" }, { "binary_version": "2.0.22-3ubuntu1.4", "binary_name": "scdaemon" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_version": "2.1.11-6ubuntu2.1", "binary_name": "dirmngr" }, { "binary_version": "2.1.11-6ubuntu2.1", "binary_name": "gnupg-agent" }, { "binary_version": "2.1.11-6ubuntu2.1", "binary_name": "gnupg2" }, { "binary_version": "2.1.11-6ubuntu2.1", "binary_name": "gpgsm" }, { "binary_version": "2.1.11-6ubuntu2.1", "binary_name": "gpgv2" }, { "binary_version": "2.1.11-6ubuntu2.1", "binary_name": "scdaemon" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "dirmngr" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gnupg" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gnupg-agent" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gnupg-l10n" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gnupg-utils" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gnupg2" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gpg" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gpg-agent" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gpg-wks-client" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gpg-wks-server" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gpgconf" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gpgsm" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gpgv" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gpgv-static" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gpgv-win32" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "gpgv2" }, { "binary_version": "2.2.4-1ubuntu1.1", "binary_name": "scdaemon" } ], "availability": "No subscription required" }