Bug 21204 - gnupg new security issue CVE-2017-7526
Summary: gnupg new security issue CVE-2017-7526
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 6
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: advisory MGA5TOO MGA5-64-OK MGA6-64-O...
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2017-07-08 20:19 CEST by David Walser
Modified: 2017-08-03 01:22 CEST (History)
3 users (show)

See Also:
Source RPM: gnupg-1.4.21-1.mga6.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2017-07-08 20:19:41 CEST 
Ubuntu has issued an advisory for libgcrypt on July 3:
https://www.ubuntu.com/usn/usn-3347-1/

gnupg is also affected and a fix is being worked on upstream:
http://openwall.com/lists/oss-security/2017/07/06/8
David Walser 2017-07-08 20:19:53 CEST

Whiteboard: (none) => MGA6TOO, MGA5TOO

Comment 1 David Walser 2017-07-27 02:53:23 CEST 
Upstream has released version 1.4.22 on July 19 to fix this:
https://www.gnupg.org/

"Although GnuPG 1.4 is of limited use today we did a maintenance release to address the recently published local side channel attack CVE-2017-7526."
Comment 2 David Walser 2017-07-30 01:46:07 CEST 
Patched package uploaded for Mageia 5.

Updated packages uploaded for Mageia 5 and Cauldron.

Advisory:
========================

Updated gnupg package fixes security vulnerability:

Daniel J. Bernstein, Joachim Breitner, Daniel Genkin, Leon Groot
Bruinderink, Nadia Heninger, Tanja Lange, Christine van Vredendaal, and
Yuval Yarom discovered that GnuPG was susceptible to an attack via
side channels. A local attacker could use this attack to recover RSA
private keys (CVE-2017-7526).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7526
http://openwall.com/lists/oss-security/2017/07/06/8
https://www.gnupg.org/
https://www.ubuntu.com/usn/usn-3347-1/
========================

Updated packages in core/updates_testing:
========================
gnupg-1.4.19-1.3.mga5
gnupg-1.4.22-1.mga6

from SRPMS:
gnupg-1.4.19-1.3.mga5.src.rpm
gnupg-1.4.22-1.mga6.src.rpm

Whiteboard: MGA6TOO, MGA5TOO => MGA5TOO
Version: Cauldron => 6
Assignee: pkg-bugs => qa-bugs

Comment 3 PC LX 2017-07-30 16:16:10 CEST 
Installed and tested without issues.

System: x86_64, Plasma, Intel CPU, nVidia GPU using proprietary driver.

$ rpm -q gnupg
gnupg-1.4.19-1.3.mga5
$ uname -a
Linux marte 4.4.79-desktop-1.mga5 #1 SMP Fri Jul 28 02:50:06 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

CC: (none) => mageia
Whiteboard: MGA5TOO => MGA5TOO MGA5-64-OK

nathan giovannini 2017-07-31 19:57:12 CEST

CC: (none) => nathan95
Whiteboard: MGA5TOO MGA5-64-OK => MGA5TOO MGA5-64-OK MGA6-64-OK

Rémi Verschelde 2017-07-31 20:03:09 CEST

Whiteboard: MGA5TOO MGA5-64-OK MGA6-64-OK => advisory MGA5TOO MGA5-64-OK MGA6-64-OK

Comment 4 nathan giovannini 2017-08-01 13:22:16 CEST 
Tested on Virtual box on MGA 6 32 bit and MGA 5 32 bit and I did not notice regressions.

Keywords: (none) => validated_update
Whiteboard: advisory MGA5TOO MGA5-64-OK MGA6-64-OK => advisory MGA5TOO MGA5-64-OK MGA6-64-OK MGA6-32-OK MGA5-32OK
CC: (none) => sysadmin-bugs

nathan giovannini 2017-08-01 13:24:27 CEST

Whiteboard: advisory MGA5TOO MGA5-64-OK MGA6-64-OK MGA6-32-OK MGA5-32OK => advisory MGA5TOO MGA5-64-OK MGA6-64-OK MGA6-32-OK MGA5-32-OK

Comment 5 Mageia Robot 2017-08-03 01:22:22 CEST 
An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2017-0235.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED
Note You need to log in before you can comment on or make changes to this bug.