Home / mailings

PDF

[USN-3064-1] GnuPG vulnerability

Posted on 18 August 2016
Ubuntu Security

==========================
==========================
========================
Ubuntu Security Notice USN-3064-1
August 18, 2016

gnupg vulnerability
==========================
==========================
========================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS

Summary:

GnuPG incorrectly generated random numbers.

Software Description:
- gnupg: GNU privacy guard - a free PGP replacement

Details:

Felix D=C3=B6rre and Vladimir Klebanov discovered that GnuPG incorrectly =
handled
mixing functions in the random number generator. An attacker able to obta=
in
4640 bits from the RNG can trivially predict the next 160 bits of output.=


Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
gnupg 1.4.20-1ubuntu3.1

Ubuntu 14.04 LTS:
gnupg 1.4.16-1ubuntu2.4

Ubuntu 12.04 LTS:
gnupg 1.4.11-3ubuntu2.10

In general, a standard system update will make all the necessary changes.=


References:
http://www.ubuntu.com/usn/usn-3064-1
CVE-2016-6313

Package Information:
https://launchpad.net/ubuntu/+source/gnupg/1.4.20-1ubuntu3.1
https://launchpad.net/ubuntu/+source/gnupg/1.4.16-1ubuntu2.4
https://launchpad.net/ubuntu/+source/gnupg/1.4.11-3ubuntu2.10



--udH8lwA4LG2KkFwfxV2oveDWkG6xisi8o--

 

TOP