Summary
It was discovered that the gpg-key2ps tool in signing-party did not
properly sanitize user IDs before passing them to a shell. If a user were
tricked into processing a specially crafted OpenPGP key, an attacker could
possibly use this issue to execute arbitrary commands.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | signing-party | 2.2-1ubuntu0.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | signing-party | 2.7-1ubuntu0.1~esm1 |
Vulnerabilities 1
-
Unscored —
gpg-key2ps in signing-party 1.1.x and 2.x before 2.10-1 contains an unsafe shell call enabling shell injection via a Us…
References
-
report
https://ubuntu.com/security/CVE-2019-11627