lp:ubuntu/raring-security/gnupg

Branch merges

Propose for merging

No branches dependent on this one.

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Related blueprints

44. By Marc Deslauriers on 2013-12-18

* SECURITY UPDATE: RSA Key Extraction via Low-Bandwidth Acoustic
  Cryptanalysis attack
  - debian/patches/CVE-2013-4576.patch: Use blinding for the RSA secret
    operation in cipher/random.*, cipher/rsa.c, g10/gpgv.c. Normalize the
    MPIs used as input to secret key functions in cipher/dsa.c,
    cipher/elgamal.c, cipher/rsa.c.
  - CVE-2013-4576

43. By Marc Deslauriers on 2013-10-08

* SECURITY UPDATE: incorrect no-usage-permitted flag handling
  - debian/patches/CVE-2013-4351.patch: correctly handle empty key flags
    in g10/getkey.c, g10/keygen.c, include/cipher.h.
  - CVE-2013-4351
* SECURITY UPDATE: denial of service via infinite recursion
  - debian/patches/CVE-2013-4402.patch: set limits on number of filters
    and nested packets in util/iobuf.c, g10/mainproc.c.
  - CVE-2013-4402

42. By Seth Arnold on 2013-07-30

* SECURITY UPDATE: The path of execution in an exponentiation function may
  depend upon secret key data, allowing a local attacker to determine the
  contents of the secret key through a side-channel attack.
  - debian/patches/CVE-2013-4242.diff: always perform the mpi_mul for
    exponents in secure memory. Based on upstream patch.
  - CVE-2013-4242

41. By Colin Watson on 2013-01-08

* Resynchronise with Debian. Remaining changes:
  - Disable mlock() test since it fails with ulimit 0 (on buildds).
  - Set gpg (or gpg2) and gpgsm to use a passphrase agent by default.
  - Only suggest gnupg-curl and libldap; recommendations are pulled into
    minimal, and we don't need the keyserver utilities in a minimal Ubuntu
    system.
  - Remove the Win32 build.
  - Update config.guess/config.sub for aarch64.

40. By Colin Watson on 2012-12-04

* Resynchronise with Debian. Remaining changes:
  - Disable mlock() test since it fails with ulimit 0 (on buildds).
  - Set gpg (or gpg2) and gpgsm to use a passphrase agent by default.
  - Only suggest gnupg-curl and libldap; recommendations are pulled into
    minimal, and we don't need the keyserver utilities in a minimal Ubuntu
    system.
  - Remove the Win32 build.
  - Update config.guess/config.sub for aarch64.
* Dropped patches:
  - Fix udeb build failure on powerpc, building with -O2 instead of -Os.
    (No longer seems to be necessary.)
* Simplify removal of Win32 build, to make this easier to merge in future.

39. By Wookey on 2012-10-01

Update config.guess,sub for aarch64

38. By Marc Deslauriers on 2012-07-24

debian/patches/long-keyids.dpatch: Use the longest key ID available
when requesting a key from a key server.

37. By Colin Watson on 2011-11-21

releasing version 1.4.11-3ubuntu2

36. By Colin Watson on 2011-11-21

Mark gnupg, gnupg-curl, and gpgv Multi-Arch: foreign.

35. By Rico Tzschichholz on 2011-02-22

* Resynchronise with Debian (LP: #720905). Remaining changes:
  - Disable mlock() test since it fails with ulimit 0 (on buildds).
  - Set gpg (or gpg2) and gpgsm to use a passphrase agent by default.
  - Fix udeb build failure on powerpc, building with -O2 instead of -Os.
  - Only suggest gnupg-curl and libldap; recommendations are pulled into
    minimal, and we don't need the keyserver utilities in a minimal Ubuntu
    system.
* debian/{control,rules}: Remove the Win32 build (and mingw32
  build-dependency), since mingw32 is in universe, and will remain so for
  the forseeable future.