Changelog
gnupg (1.4.2.1-0ubuntu1) dapper; urgency=low
* New upstream security bugfix release, only contains the following changes:
- Security fix for a verification weakness in gpgv. Some input
could lead to gpgv exiting with 0 even if the detached signature
file did not carry any signature. This is not as fatal as it
might seem because the suggestion as always been not to rely on
th exit code but to parse the --status-fd messages. However it
is likely that gpgv is used in that simplified way and thus we
do this release. Same problem with "gpg --verify" but nobody
should have used this for signature verification without
checking the status codes anyway. [CVE-2006-0455]
- Added a test case for above vulnerability.
* debian/rules: Call the test suite during build. (Will fail the build
if the test suite fails.)
-- Martin Pitt <email address hidden> Fri, 17 Feb 2006 11:18:27 +0100
